US 12,093,414 B1
Efficient detection of in-memory data accesses and context information
Ricardo Rodriguez Munoz, Renton, WA (US); and Karthikeyan Mahadevan, Sammamish, WA (US)
Assigned to Amazon Technologies, Inc., Seattle, WA (US)
Filed by Amazon Technologies, Inc., Seattle, WA (US)
Filed on Dec. 9, 2019, as Appl. No. 16/708,157.
Int. Cl. G06F 21/62 (2013.01)
CPC G06F 21/6218 (2013.01) 20 Claims
OG exemplary drawing
 
6. A method, comprising:
performing, at one or more computing devices:
causing a respective memory access tracking agent to be configured at individual ones of one or more sources to track access requests originating from the individual sources directed to a set of target data structures classified as sensitive data structures comprising sensitive data associated with an application, wherein the classification is based at least in part on respective data structure names or other identifiers indicated in respective source code or executable code associated with the target data structures, wherein the respective memory access tracking agent comprises dynamically injected executable code injected into one or more programs associated with the application;
detecting, at a first memory access tracking agent of the respective memory tracking agents, an access request directed to a particular in-memory representation of a first target data structure of the set of indicated target data structures comprising the sensitive data, wherein the access request is detected at least in part using the dynamically injected executable code;
determining, by the first memory access tracking agent, run-time context information pertaining to the access request, wherein the run-time context information comprises at least a portion of a thread stack; and
causing respective indications of (a) the occurrence of the access request and (b) at least a portion of the obtained run-time context information to be provided to one or more destinations, wherein the portion of the obtained context information is transformed in accordance with a transformation descriptor obtained via a programmatic interface.