US2014215276A1PendingUtilityA1

Methods, media, and systems for detecting anomalous program executions

57
Assignee: UNIV COLUMBIAPriority: Oct 25, 2005Filed: Aug 30, 2013Published: Jul 31, 2014
Est. expiryOct 25, 2025(expired)· nominal 20-yr term from priority
Inventors:Salvatore J. StolfoAngelos D. KeromytisStylianos Sidiroglou
G06F 11/3652G06F 11/0718G06F 11/0751G06F 11/079G06F 11/0772
57
PatentIndex Score
0
Cited by
0
References
0
Claims

Abstract

Methods, media, and systems for detecting anomalous program executions are provided. In some embodiments, methods for detecting anomalous program executions are provided, comprising: executing at least a part of a program in an emulator; comparing a function call made in the emulator to a model of function calls for the at least a part of the program; and identifying the function call as anomalous based on the comparison. In some embodiments, methods for detecting anomalous program executions are provided, comprising: modifying a program to include indicators of program-level function calls being made during execution of the program; comparing at least one of the indicators of program-level function calls made in the emulator to a model of function calls for the at least a part of the program; and identifying a function call corresponding to the at least one of the indicators as anomalous based on the comparison.

Claims

exact text as granted — not AI-modified
1 . A method for detecting anomalous program executions, comprising:
 executing at least a part of a program in an emulator;   comparing a function call made in the emulator to a model of function calls for the at least a part of the program; and   identifying the function call as anomalous based on the comparison.   
     
     
         2 - 42 . (canceled)

Cited by (0)

No later patents cite this yet.

References (0)

No backward citations on record.