US 11,698,964 B2
Malware detection in memory
Danyu Bi, Shanghai (CN); Salmin Sultana, Hillsboro, OR (US); Yuanyuan Li, Shanghai (CN); Yong Jiang, Shanghai (CN); Pramod Pesara, Portland, OR (US); Selvakumar Panneer, Portland, OR (US); and Ravi Sahita, Portland, OR (US)
Assigned to INTEL CORPORATION, Santa Clara, CA (US)
Appl. No. 16/650,643
Filed by INTEL CORPORATION, Santa Clara, CA (US)
PCT Filed Dec. 13, 2017, PCT No. PCT/CN2017/115955
§ 371(c)(1), (2) Date Mar. 25, 2020,
PCT Pub. No. WO2019/113843, PCT Pub. Date Jun. 20, 2019.
Prior Publication US 2020/0320196 A1, Oct. 8, 2020
Int. Cl. G06F 21/56 (2013.01); G06F 9/448 (2018.01); G06F 9/30 (2018.01); G06F 11/36 (2006.01); G06F 12/1009 (2016.01); H04L 9/40 (2022.01)
CPC G06F 21/56 (2013.01) [G06F 9/30061 (2013.01); G06F 9/448 (2018.02); G06F 11/3636 (2013.01); G06F 12/1009 (2013.01); G06F 21/566 (2013.01); H04L 63/145 (2013.01); H04L 63/1441 (2013.01)] 21 Claims
OG exemplary drawing
 
8. A method for detecting malware comprising:
collecting processor trace information corresponding to instructions for an application being executed by a processor, the instructions to include an indirect branch instruction, the processor trace information to indicate a memory address of the indirect branch instruction;
determining whether the memory address of the indirect branch instruction is listed in a set of allowed target addresses for the indirect branch instruction;
detecting a control flow integrity (CFI) violation of a CFI policy associated with the application being executed by the processor when the memory address of the indirect branch instruction is not listed in the set of allowed target addresses for the indirect branch instruction;
initiating scanning of executed memory pages associated with the application being executed by the processor in response to detection of the CFI violation, the memory pages organized into different priority queues to prioritize an order for the memory page scans;
detecting at least one malware instruction being executed by the application in response to scanning the memory pages organized into the different priority queues; and
blocking the application from accessing or modifying memory.