Methods, media and systems for detecting anomalous program executions

Abstract

Methods, media, and systems for detecting anomalous program executions are provided. In some embodiments, methods for detecting anomalous program executions are provided, comprising: executing at least a part of a program in an emulator; comparing a function call made in the emulator to a model of function calls for the at least a part of the program; and identifying the function call as anomalous based on the comparison. In some embodiments, methods for detecting anomalous program executions are provided, comprising: modifying a program to include indicators of program-level function calls being made during execution of the program; comparing at least one of the indicators of program-level function calls made in the emulator to a model of function calls for the at least a part of the program; and identifying a function call corresponding to the at least one of the indicators as anomalous based on the comparison.

1 . (canceled) 
     
     
         2 . A method for detecting anomalous program executions, the method comprising:
 causing, using the hardware processor, an emulator to selectively execute at least a part of a program;   comparing, using the hardware processor, a function call made in the emulator to a model of function calls for the at least a part of the program;   identifying, using the hardware processor, that the function call deviates from normal based on the comparing and that the function call may correspond to an attack; and   in response to identifying the function call as deviating from normal, notifying, using the hardware processor, a plurality of computers running at least a selected portion of the program of the identified function call.   
     
     
         3 . The method of  claim 2 , wherein the model of function calls reflects normal activity of the at least a part of the program. 
     
     
         4 . The method of  claim 3 , wherein the normal activity of the at least a part of the program reflected in the model of function calls includes information about normal program execution stack behavior during program execution, which contains information about executed function calls. 
     
     
         5 . The method of  claim 2 , wherein the model of function calls incorporates information about known or suspected attacks against the at least a part of the program. 
     
     
         6 . The method of  claim 2 , wherein the emulator selectively executes all of the program. 
     
     
         7 . The method of  claim 2 , further comprising, in addition to selectively executing the at least a part of the program, performing a simulation of the at least a part of the program that is separate from the selectively executing the at least a part of the program. 
     
     
         8 . The method of  claim 2 , wherein the plurality of computers are running the same program. 
     
     
         9 . The method of  claim 2 , wherein the plurality of computers run the program or a portion thereof to build the model of function calls for the at least a part of the program. 
     
     
         10 . The method of  claim 2 , wherein the plurality of computers run an application that allows the plurality of computers to share information that is used to build the model of function calls for the at least a part of the program. 
     
     
         11 . The method of  claim 2 , wherein the model of function calls is generated in whole or in part from executing function calls. 
     
     
         12 . The method of  claim 11 , wherein the emulator selectively executes all of the program. 
     
     
         13 . The method of  claim 11 , further comprising, in addition to selectively executing the at least a part of the program, performing a simulation of the at least a part of the program that is separate from the selectively executing the at least a part of the program. 
     
     
         14 . The method of  claim 11 , wherein the members of the community include the plurality of computers running the same program. 
     
     
         15 . The method of  claim 11 , wherein the plurality of computers run the program or a portion thereof to build the model of function calls for the at least a part of the program. 
     
     
         16 . The method of  claim 11 , wherein the plurality of computers run an application that allows the plurality of computers to share information that is used to build the model of function calls for the at least a part of the program. 
     
     
         17 . The method of  claim 2 , wherein the model of function calls is generated in whole or in part from executing function calls and wherein the comparing the function call made in the emulator to the model of function calls for the at least a part of the program is based on a statistical analysis. 
     
     
         18 . The method of  claim 17 , wherein the emulator selectively executes all of the program. 
     
     
         19 . The method of  claim 17 , further comprising, in addition to selectively executing the at least a part of the program, performing a simulation of the at least a part of the program that is separate from the selectively executing the at least a part of the program. 
     
     
         20 . The method of  claim 17 , wherein the members of the community include the plurality of computers running the same program. 
     
     
         21 . The method of  claim 17 , wherein the plurality of computers run the program or a portion thereof to build the model of function calls for the at least a part of the program. 
     
     
         22 . The method of  claim 17 , wherein the plurality of computers run an application that allows the plurality of computers to share information that is used to build the model of function calls for the at least a part of the program. 
     
     
         23 . The method of  claim 2 , wherein the model of function calls is generated in whole or in part from executing function calls, wherein the comparing the function call made in the emulator to the model of function calls for the at least a part of the program is based on a statistical analysis, and wherein the model of function calls incorporates information about known or suspected attacks against the at least a part of the program. 
     
     
         24 . The method of  claim 23 , wherein the emulator selectively executes all of the program. 
     
     
         25 . The method of  claim 23 , further comprising, in addition to selectively executing the at least a part of the program, performing a simulation of the at least a part of the program that is separate from the selectively executing the at least a part of the program. 
     
     
         26 . The method of  claim 23 , wherein the members of the community include the plurality of computers running the same program. 
     
     
         27 . The method of  claim 23 , wherein the plurality of computers run the program or a portion thereof to build the model of function calls for the at least a part of the program. 
     
     
         28 . The method of  claim 23 , wherein the plurality of computers run an application that allows the plurality of computers to share information that is used to build the model of function calls for the at least a part of the program.