Methods, media and systems for detecting anomalous program executions

Abstract

Methods, media, and systems for detecting anomalous program executions are provided. In some embodiments, methods for detecting anomalous program executions are provided, comprising: executing at least a part of a program in an emulator; comparing a function call made in the emulator to a model of function calls for the at least a part of the program; and identifying the function call as anomalous based on the comparison. In some embodiments, methods for detecting anomalous program executions are provided, comprising: modifying a program to include indicators of program-level function calls being made during execution of the program; comparing at least one of the indicators of program-level function calls made in the emulator to a model of function calls for the at least a part of the program; and identifying a function call corresponding to the at least one of the indicators as anomalous based on the comparison.

1 . A method for detecting anomalous program executions, the method comprising:
 causing, using the hardware processor, an emulator to selectively execute at least a part of a program;   comparing, using the hardware processor, a function call made in the emulator to a model of function calls for the at least a part of the program;   identifying, using the hardware processor, that the function call deviates from normal based on the comparing and that the function call may correspond to an attack; and   in response to identifying the function call as deviating from normal, notifying, using the hardware processor, a plurality of computers running at least a selected portion of the program of the identified function call.   
     
     
         2 . The method of  claim 1 , wherein the model of function calls reflects normal activity of the at least a part of the program. 
     
     
         3 . The method of  claim 2 , wherein the normal activity of the at least a part of the program reflected in the model of function calls includes information about normal program execution stack behavior during program execution, which contains information about executed function calls. 
     
     
         4 . The method of  claim 1 , wherein the model of function calls incorporates information about known or suspected attacks against the at least a part of the program. 
     
     
         5 . The method of  claim 1 , wherein the emulator selectively executes all of the program. 
     
     
         6 . The method of  claim 1 , further comprising, in addition to selectively executing the at least a part of the program, performing a simulation that continues to execute the program and that is separate from the selectively executing the at least a part of the program, wherein the simulation returns an error return from a function of the program. 
     
     
         7 . The method of  claim 1 , wherein the plurality of computers are running the same program. 
     
     
         8 . The method of  claim 1 , wherein the plurality of computers run the program or a portion thereof to build the model of function calls for the at least a part of the program. 
     
     
         9 . The method of  claim 1 , wherein the plurality of computers run an application that shares information that is used to build the model of function calls for the at least a part of the program. 
     
     
         10 . The method of  claim 1 , wherein the model of function calls is generated in whole or in part from executing function calls. 
     
     
         11 . The method of  claim 10 , wherein the emulator selectively executes all of the program. 
     
     
         12 . The method of  claim 10 , further comprising, in addition to selectively executing the at least a part of the program, performing a simulation that continues to execute the program and that is separate from the selectively executing the at least a part of the program, wherein the simulation returns an error return from a function of the program. 
     
     
         13 . The method of  claim 10 , wherein the members of the community include the plurality of computers running the same program. 
     
     
         14 . The method of  claim 10 , wherein the plurality of computers run the program or a portion thereof to build the model of function calls for the at least a part of the program. 
     
     
         15 . The method of  claim 10 , wherein the plurality of computers run an application that shares information that is used to build the model of function calls for the at least a part of the program. 
     
     
         16 . The method of  claim 1 , wherein the model of function calls is generated in whole or in part from executing function calls and wherein the comparing the function call made in the emulator to the model of function calls for the at least a part of the program is based on a statistical analysis. 
     
     
         17 . The method of  claim 16 , wherein the emulator selectively executes all of the program. 
     
     
         18 . The method of  claim 16 , further comprising, in addition to selectively executing the at least a part of the program, performing a simulation that continues to execute the program and that is separate from the selectively executing the at least a part of the program, wherein the simulation returns an error return from a function of the program. 
     
     
         19 . The method of  claim 16 , wherein the members of the community include the plurality of computers running the same program. 
     
     
         20 . The method of  claim 16 , wherein the plurality of computers run the program or a portion thereof to build the model of function calls for the at least a part of the program. 
     
     
         21 . The method of  claim 16 , wherein the plurality of computers run an application that shares information that is used to build the model of function calls for the at least a part of the program. 
     
     
         22 . The method of  claim 1 , wherein the model of function calls is generated in whole or in part from executing function calls, wherein the comparing the function call made in the emulator to the model of function calls for the at least a part of the program is based on a statistical analysis, and wherein the model of function calls incorporates information about known or suspected attacks against the at least a part of the program. 
     
     
         23 . The method of  claim 22 , wherein the emulator selectively executes all of the program. 
     
     
         24 . The method of  claim 22 , further comprising, in addition to selectively executing the at least a part of the program, performing a simulation that continues to execute the program and that is separate from the selectively executing the at least a part of the program, wherein the simulation returns an error return from a function of the program. 
     
     
         25 . The method of  claim 22 , wherein the members of the community include the plurality of computers running the same program. 
     
     
         26 . The method of  claim 22 , wherein the plurality of computers run the program or a portion thereof to build the model of function calls for the at least a part of the program. 
     
     
         27 . The method of  claim 22 , wherein the plurality of computers run an application that shares information that is used to build the model of function calls for the at least a part of the program.