公开(公告)号：US20180189489A1

公开(公告)日：2018-07-05

申请号：US15395053

申请日：2016-12-30

申请人： Mingwei Zhang ,  Xiaoning Li ,  Ravi L. Sahita ,  Aravind Subramanian ,  Abhay S. Kanhere ,  Chih-Yuan Yang ,  Yi Gai

发明人： Mingwei Zhang ,  Xiaoning Li ,  Ravi L. Sahita ,  Aravind Subramanian ,  Abhay S. Kanhere ,  Chih-Yuan Yang ,  Yi Gai

IPC分类号： G06F21/56 ,  H04L29/06 ,  G06N99/00

摘要： A malicious object detection system for use in managed runtime environments includes a check circuit to receive call information generated by an application, such as an Android application. A machine learning circuit coupled to the check circuit applies a machine learning model to assess the information and/or data included in the call and detect the presence of a malicious object, such as malware or a virus, in the application generating the call. The machine learning model may include a global machine learning model distributed across a number of devices, a local machine learning model based on use patterns of a particular device, or combinations thereof. A graphical user interface management circuit halts execution of applications containing malicious objects and generates a user perceptible output.

公开(公告)号：US20170255416A1

公开(公告)日：2017-09-07

申请号：US15061489

申请日：2016-03-04

申请人： Mingwei Zhang ,  Ravi L. Sahita

发明人： Mingwei Zhang ,  Ravi L. Sahita

IPC分类号： G06F3/06 ,  G06F21/53

摘要： Technologies for defeating secure enclave side-channel attacks include a computing device having a processor with secure enclave support. The computing device instruments an executable binary with multiple gadgets, a fault-generating function, and at least one invocation of the fault-generating function. The computing device executes the instrumented executable binary within a secure enclave. During execution of the instrumented binary, each gadget may be located at a different memory page of the secure enclave. The computing device invokes the fault-generating function, which selects a random sequence of the gadgets and executes the random sequence of gadgets. The processor may generate a page fault in response to executing each of the gadgets. Each gadget may generate one or more data accesses to memory pages within the secure enclave. The processor may generate a page fault in response to each of the data accesses. Other embodiments are described and claimed.

公开(公告)号：US08578080B2

公开(公告)日：2013-11-05

申请号：US13175544

申请日：2011-07-01

申请人： Ravi L. Sahita ,  Xiaoning Li ,  Manohar R. Castelino

发明人： Ravi L. Sahita ,  Xiaoning Li ,  Manohar R. Castelino

IPC分类号： G06F13/32 ,  G06F13/24

CPC分类号： G06F13/24 ,  G06F9/45558 ,  G06F21/53 ,  G06F2009/45579

摘要： Various embodiments of this disclosure may describe method, apparatus and system for reducing system latency caused by switching memory page permission views between programs while still protecting critical regions of the memory from attacks of malwares. Other embodiments may be disclosed and claimed.

摘要翻译： 本公开的各种实施例可以描述用于减少由程序之间切换存储​​器页面许可视图而引起的系统延迟的方法，装置和系统，同时仍保护存储器的关键区域免受恶意软件的攻击。 可以公开和要求保护其他实施例。

公开(公告)号：US20180046803A1

公开(公告)日：2018-02-15

申请号：US15235806

申请日：2016-08-12

申请人： Xiaoning Li ,  Ravi L. Sahita ,  David M. Durham

发明人： Xiaoning Li ,  Ravi L. Sahita ,  David M. Durham

IPC分类号： G06F21/56 ,  G06F21/52 ,  G06F11/14

CPC分类号： G06F21/566 ,  G06F11/1417 ,  G06F11/302 ,  G06F11/3089 ,  G06F21/54 ,  G06F2201/84

摘要： Technologies for hardware assisted native malware detection include a computing device. The computing device includes one or more processors with hook logic to monitor for execution of branch instructions of an application, compare the monitored branch instructions to filter criteria, and determine whether a monitored branch instruction satisfies the filter criteria. Additionally, the computing device includes a malware detector to provide the filter criteria to the hook logic, provide an address of a callback function to the hook logic to be executed in response to a determination that a monitored branch instruction satisfies the filter criteria, and analyze, in response to execution of the callback function, the monitored branch instruction to determine whether the monitored branch instruction is indicative of malware. Other embodiments are also described and claimed.

公开(公告)号：US20130007325A1

公开(公告)日：2013-01-03

申请号：US13175544

申请日：2011-07-01

申请人： Ravi L. Sahita ,  Xiaoning Li ,  Manohar R. Castelino

发明人： Ravi L. Sahita ,  Xiaoning Li ,  Manohar R. Castelino

IPC分类号： G06F13/24

CPC分类号： G06F13/24 ,  G06F9/45558 ,  G06F21/53 ,  G06F2009/45579

摘要： Various embodiments of this disclosure may describe method, apparatus and system for reducing system latency caused by switching memory page permission views between programs while still protecting critical regions of the memory from attacks of malwares. Other embodiments may be disclosed and claimed.

摘要翻译： 本公开的各种实施例可以描述用于减少由程序之间切换存储​​器页面许可视图而引起的系统延迟的方法，装置和系统，同时仍保护存储器的关键区域免受恶意软件的攻击。 可以公开和要求保护其他实施例。

公开(公告)号：US20160180079A1

公开(公告)日：2016-06-23

申请号：US14576665

申请日：2014-12-19

申请人： Ravi L. Sahita ,  Xiaoning Li ,  Barry E. Huntley ,  Ofer Levy ,  Vedvyas Shanbhogue ,  Yuriy Bulygin ,  Ido Ouziel ,  Michael Lemay ,  John M. Esper

发明人： Ravi L. Sahita ,  Xiaoning Li ,  Barry E. Huntley ,  Ofer Levy ,  Vedvyas Shanbhogue ,  Yuriy Bulygin ,  Ido Ouziel ,  Michael Lemay ,  John M. Esper

IPC分类号： G06F21/52

CPC分类号： G06F21/52 ,  G06F9/45558 ,  G06F11/30 ,  G06F21/554 ,  G06F2009/45591 ,  G06F2221/033

摘要： A method comprises filtering branch trap events at a branch event filter, monitoring a branch event filter to capture indirect branch trap events that cause a control flow trap exception, receiving the indirect branch trap events at a handler and the handler processing the indirect branch trap events

摘要翻译： 一种方法包括在分支事件过滤器处过滤分支陷阱事件，监视分支事件过滤器以捕获导致控制流陷阱异常的间接分支陷阱事件，在处理器处接收间接分支陷阱事件，并处理处理间接分支陷阱事件

公开(公告)号：US20160283714A1

公开(公告)日：2016-09-29

申请号：US14670988

申请日：2015-03-27

申请人： Michael LeMay ,  Ravi L. Sahita ,  Beeman C. Strong ,  Thilo Schmitt ,  Yuriy Bulygin ,  Markus T. Metzger

发明人： Michael LeMay ,  Ravi L. Sahita ,  Beeman C. Strong ,  Thilo Schmitt ,  Yuriy Bulygin ,  Markus T. Metzger

IPC分类号： G06F21/56 ,  G06F21/44

CPC分类号： G06F21/56 ,  G06F21/44 ,  G06F21/52

摘要： Technologies for control flow exploit mitigation include a computing device having a processor with real-time instruction tracing support. During execution of a process, the processor generates trace data indicative of control flow of the process. The computing device analyzes the trace data to identify suspected control flow exploits. The computing device may use heuristic algorithms to identify return-oriented programming exploits. The computing device may maintain a shadow stack based on the trace data. The computing device may identify indirect branches to unauthorized addresses based on the trace data to identify jump-oriented programming exploits. The computing device may check the trace data whenever the process is preempted. The processor may detect mispredicted return instructions in real time and invoke a software handler in the process space of the process to verify and maintain the shadow stack. Other embodiments are described and claimed.

摘要翻译： 用于控制流利用减轻的技术包括具有具有实时指令跟踪支持的处理器的计算设备。 在处理过程中，处理器产生指示过程控制流的跟踪数据。 计算设备分析跟踪数据以识别可疑的控制流攻击。 计算设备可以使用启发式算法来识别返回导向的编程漏洞。 计算设备可以基于跟踪数据来维护阴影栈。 计算设备可以基于跟踪数据来识别对未授权地址的间接分支，以识别面向跳跃的编程漏洞。 每当进程被抢占时，计算设备可以检查跟踪数据。 处理器可以实时地检测错误的返回指令，并且在该过程的过程空间中调用软件处理程序以验证和维护该影子栈。 描述和要求保护其他实施例。

公开(公告)号：US09286245B2

公开(公告)日：2016-03-15

申请号：US13995360

申请日：2011-12-30

申请人： David M. Durham ,  Ravi L. Sahita ,  Prashant Dewan

发明人： David M. Durham ,  Ravi L. Sahita ,  Prashant Dewan

IPC分类号： G06F21/00 ,  G06F12/14 ,  G06F21/50 ,  G06F21/12 ,  G06F21/79

CPC分类号： G06F12/1458 ,  G06F21/121 ,  G06F21/50 ,  G06F21/79

摘要： Embodiments of apparatuses and methods for hardware enforced memory access permissions are disclosed. In one embodiment, a processor includes address translation hardware and memory access hardware. The address translation hardware is to support translation of a first address, used by software to access a memory, to a second address, used by the processor to access the memory. The memory access hardware is to detect an access permission violation.

摘要翻译： 公开了用于硬件强制存储器访问许可的装置和方法的实施例。 在一个实施例中，处理器包括地址转换硬件和存储器访问硬件。 地址转换硬件是支持由软件使用的访问存储器的第一地址到由处理器使用以访问存储器的第二地址的翻译。 内存访问硬件是检测访问权限冲突。

公开(公告)号：US20140380009A1

公开(公告)日：2014-12-25

申请号：US14127561

申请日：2013-06-24

申请人： Michael Lemay ,  David M. Durham ,  Ravi L. Sahita ,  Andrew V. Anderson

发明人： Michael Lemay ,  David M. Durham ,  Ravi L. Sahita ,  Andrew V. Anderson

IPC分类号： G06F12/14 ,  G06F9/455 ,  G06F12/10

CPC分类号： G06F12/145 ,  G06F9/30076 ,  G06F9/45558 ,  G06F12/1009 ,  G06F12/1491 ,  G06F2009/45583 ,  G06F2212/1052 ,  G06F2212/151

摘要： Generally, this disclosure provides systems, methods and computer readable media for a protected memory view in a virtual machine (VM) environment enabling nested page table access by trusted guest software outside of VMX root mode. The system may include an editor module configured to provide access to a nested page table structure, by operating system (OS) kernel components and by user space applications within a guest of the VM, wherein the nested page table structure is associated with one of the protected memory views. The system may also include a page handling processor configured to secure that access by maintaining security information in the nested page table structure.

摘要翻译： 通常，本公开提供了用于虚拟机（VM）环境中的受保护的存储器视图的系统，方法和计算机可读介质，其实现了受VMX根模式之外的受信任客户机的嵌套页表访问。 该系统可以包括被配置为通过操作系统（OS）内核组件和由VM的来宾内的用户空间应用提供对嵌套页表结构的访问的编辑器模块，其中嵌套页表结构与 受保护的内存视图。 该系统还可以包括页面处理处理器，其被配置为通过维护嵌套页表结构中的安全信息来保护该访问。

公开(公告)号：US20140157410A1

公开(公告)日：2014-06-05

申请号：US13690401

申请日：2012-11-30

申请人： Prashant Dewan ,  Uday R. Savagaonkar ,  David M. Durham ,  Paul S. Schmitz ,  Jason Martin ,  Michael Goldsmith ,  Ravi L. Sahita ,  Frank X McKeen ,  Carlos Rozas ,  Vembu Balaji ,  Scott Janus ,  Geoffrey S. Strongin ,  Xiaozhu Kang ,  Karanvir S. Grewal ,  Siddhartha Chhabra ,  Alpha T. Narendra Trivedi

发明人： Prashant Dewan ,  Uday R. Savagaonkar ,  David M. Durham ,  Paul S. Schmitz ,  Jason Martin ,  Michael Goldsmith ,  Ravi L. Sahita ,  Frank X McKeen ,  Carlos Rozas ,  Vembu Balaji ,  Scott Janus ,  Geoffrey S. Strongin ,  Xiaozhu Kang ,  Karanvir S. Grewal ,  Siddhartha Chhabra ,  Alpha T. Narendra Trivedi

IPC分类号： G06F21/64

CPC分类号： G06F21/64 ,  G06F21/53 ,  G06F21/56

摘要： In accordance with some embodiments, a protected execution environment may be defined for a graphics processing unit. This framework not only protects the workloads from malware running on the graphics processing unit but also protects those workloads from malware running on the central processing unit. In addition, the trust framework may facilitate proof of secure execution by measuring the code and data structures used to execute the workload. If a part of the trusted computing base of this framework or protected execution environment is compromised, that part can be patched remotely and the patching can be proven remotely throughout attestation in some embodiments.

摘要翻译： 根据一些实施例，可以为图形处理单元定义受保护的执行环境。 该框架不仅保护了图形处理单元上运行的恶意软件的工作负载，还保护了这些工作负载免受中央处理单元上运行的恶意软件。 此外，信任框架可以通过测量用于执行工作负载的代码和数据结构来促进安全执行的证明。 如果该框架或受保护的执行环境的可信计算基础的一部分受到损害，那么该部分可以被远程修补，并且在一些实施例中可以通过验证远程验证修补。