US 12,032,661 B2
Hardware-assisted system and method for detecting and analyzing system calls made to an operating system kernel
Matthew D. Spisak, Columbus, OH (US)
Assigned to Endgame, Inc., Arlington, VA (US)
Filed by Endgame, Inc., Arlington, VA (US)
Filed on Jun. 14, 2021, as Appl. No. 17/347,402.
Application 17/347,402 is a continuation of application No. 15/224,521, filed on Jul. 30, 2016, granted, now 11,120,106.
Prior Publication US 2021/0303658 A1, Sep. 30, 2021
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/00 (2013.01); G06F 21/12 (2013.01); G06F 21/56 (2013.01); G06F 21/62 (2013.01)
CPC G06F 21/00 (2013.01) [G06F 21/126 (2013.01); G06F 21/56 (2013.01); G06F 21/563 (2013.01); G06F 21/566 (2013.01); G06F 21/121 (2013.01); G06F 21/6281 (2013.01); G06F 2221/034 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A system for identifying and analyzing system calls to identify potentially malicious software code, the system comprising:
a processor comprising a performance monitoring unit and configured to run an operating system, the operating system comprising a kernel;
a system call monitoring module, executed by the processor, for configuring the performance monitoring unit to:
identify a system call and one or more hardware interrupts to the kernel, by trapping one or more FAR branches that are destined for the kernel, thereby allowing the system to encapsulate a system call instruction that generates the system call and one or more hardware interrupts, wherein the system call comprises the one or more FAR branches; and
generate monitoring data from the system call; and
a data analysis module, executed by the processor, to analyze the monitoring data in light of previously stored data, to learn from the previously stored data and the monitoring data, and to generate an alert based on the monitoring data, the alert indicating that the system call was generated by potentially malicious software code.