| CPC G06F 21/556 (2013.01) [G06F 21/54 (2013.01); G06F 21/554 (2013.01)] | 20 Claims |

|
1. A method for detecting an exploit in a processing instruction, comprising the steps of:
receiving processor instructions;
analyzing said processor instructions to detect data flow instructions;
trimming out said data flow instructions;
comparing said data flow instructions to a pre-defined pattern for exploit behavior; and
generating an exploit notification in response to detecting said pre-defined pattern for exploit behavior in said data flow instructions, wherein
(i) trimming out said data flow instructions comprises removing computational commands and keeping (a) interrupt commands and (b) execution control flow commands, and
(ii) a number of said data flow instructions are stored in a rolling buffer to enable detecting said pre-defined pattern for exploit behavior.
|