专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

US20170169216A1 COMPILER ASSISTED PROTECTION AGAINST ARBITRARY CODE EXECUTION 审中-公开
公开(公告)号：US20170169216A1
公开(公告)日：2017-06-15
申请号：US14965939
申请日：2015-12-11
申请人： International Business Machines Corporation
发明人： Omer Y. Boehm , Yousef Shajrawi
IPC分类号： G06F21/54 , G06F21/51 , G06F3/06
CPC分类号： G06F21/54 , G06F21/51 , G06F2221/033
摘要： A method, computer program product, and computer system are provided. A processor receives an executable file for execution by an operating system, where the executable file includes a plurality of sections in a first order. A processor determines a second order that indicates a loading order for the plurality of sections, where the second order is distinct from the first order. A processor loads the plurality of sections of the executable file into a plurality of locations in memory of a device based on the second order. A processor resolves one or more memory references for the plurality of sections based on the plurality of locations in memory. A processor executes the plurality of sections of the executable file in the plurality of locations in memory.

2. 发明授权

US09576138B1 Mitigating ROP attacks 有权
标题翻译：减轻ROP攻击
公开(公告)号：US09576138B1
公开(公告)日：2017-02-21
申请号：US14870050
申请日：2015-09-30
申请人： International Business Machines Corporation
发明人： Omer Y. Boehm , Eitan D. Farchi , Oded Margalit , Yousef Shajrawi , Michael Vinov
IPC分类号： G06F11/00 , G06F21/60 , G06F21/55
CPC分类号： G06F21/55 , G06F3/0623 , G06F3/064 , G06F3/0673 , G06F12/0646 , G06F21/52 , G06F21/54 , G06F21/566 , G06F21/60 , G06F2212/1052 , G06N99/005
摘要： Mitigating return-oriented programming attacks. From program code and associated components needed by the program code for execution, machine language instruction sequences that may be combined and executed as malicious code are selected. A predetermined number of additional copies of each of the selected machine language instruction sequences are made, and the additional copies are marked as non-executable. The machine language instruction sequences and the non-executable copies are distributed in memory. If a process attempts to execute a machine language instruction sequence that has been marked non-executable, the computer may initiate protective action.
摘要翻译：减轻面向回归的编程攻击。从用于执行的程序代码所需的程序代码和相关组件中，选择可以组合和执行为恶意代码的机器语言指令序列。制作每个所选机器语言指令序列的预定数目的附加副本，并且附加副本被标记为不可执行。机器语言指令序列和不可执行副本分布在存储器中。如果进程尝试执行已被标记为不可执行的机器语言指令序列，则计算机可能启动保护动作。

3. 发明授权

US09665717B2 Mitigating ROP attacks 有权
公开(公告)号：US09665717B2
公开(公告)日：2017-05-30
申请号：US15263782
申请日：2016-09-13
申请人： International Business Machines Corporation
发明人： Omer Y. Boehm , Eitan D. Farchi , Oded Margalit , Yousef Shajrawi , Michael Vinov
IPC分类号： G06F11/00 , G06F21/56 , G06F3/06
CPC分类号： G06F21/55 , G06F3/0623 , G06F3/064 , G06F3/0673 , G06F12/0646 , G06F21/52 , G06F21/54 , G06F21/566 , G06F21/60 , G06F2212/1052 , G06N99/005
摘要： Mitigating return-oriented programming (ROP) attacks. Program code and associated components are received and loaded into memory. From the program code and associated components, a predetermined number of sequences of machine language instructions that terminate in a return instruction are selected. The sequences of machine language instructions include: machine language instruction sequences that are equivalent to a conditional statement “if-then-else return,” sequences of machine language instructions corresponding to known malicious code sequences, and sequences of machine language instructions corresponding to machine language instructions in known toolkits for assembling malicious code sequences. For each selected machine language instruction sequence, memory blocks containing the selected machine language instruction sequence are rearranged using address space layout randomization (ASLR); then, upon expiration of an expected time interval required to locate the selected machine language instruction sequence by inspecting the rearranged memory blocks, the rearranging is repeated, thereby mitigating ROP attacks.

4. 发明申请

US20170091449A1 MITIGATING ROP ATTACKS 有权
公开(公告)号：US20170091449A1
公开(公告)日：2017-03-30
申请号：US15132739
申请日：2016-04-19
申请人： International Business Machines Corporation
发明人： Omer Y. Boehm , Eitan D. Farchi , Oded Margalit , Yousef Shajrawi , Michael Vinov
IPC分类号： G06F21/55 , G06N99/00
CPC分类号： G06F21/55 , G06F3/0623 , G06F3/064 , G06F3/0673 , G06F12/0646 , G06F21/52 , G06F21/54 , G06F21/566 , G06F21/60 , G06F2212/1052 , G06N99/005
摘要： Mitigating return-oriented programming attacks. From program code and associated components needed by the program code for execution, machine language instruction sequences that may be combined and executed as malicious code are selected. A predetermined number of additional copies of each of the selected machine language instruction sequences are made, and the additional copies are marked as non-executable. The machine language instruction sequences and the non-executable copies are distributed in memory. If a process attempts to execute a machine language instruction sequence that has been marked non-executable, the computer may initiate protective action.

5. 发明申请

US20170091456A1 MITIGATING ROP ATTACKS 有权
公开(公告)号：US20170091456A1
公开(公告)日：2017-03-30
申请号：US15263782
申请日：2016-09-13
申请人： International Business Machines Corporation
发明人： Omer Y. Boehm , Eitan D. Farchi , Oded Margalit , Yousef Shajrawi , Michael Vinov
IPC分类号： G06F21/56 , G06F3/06
CPC分类号： G06F21/55 , G06F3/0623 , G06F3/064 , G06F3/0673 , G06F12/0646 , G06F21/52 , G06F21/54 , G06F21/566 , G06F21/60 , G06F2212/1052 , G06N99/005
摘要： Mitigating return-oriented programming (ROP) attacks. Program code and associated components are received and loaded into memory. From the program code and associated components, a predetermined number of sequences of machine language instructions that terminate in a return instruction are selected. The sequences of machine language instructions include: machine language instruction sequences that are equivalent to a conditional statement “if-then-else return,” sequences of machine language instructions corresponding to known malicious code sequences, and sequences of machine language instructions corresponding to machine language instructions in known toolkits for assembling malicious code sequences. For each selected machine language instruction sequence, memory blocks containing the selected machine language instruction sequence are rearranged using address space layout randomization (ASLR); then, upon expiration of an expected time interval required to locate the selected machine language instruction sequence by inspecting the rearranged memory blocks, the rearranging is repeated, thereby mitigating ROP attacks.

6. 发明申请

US20170091447A1 MITIGATING ROP ATTACKS 有权
公开(公告)号：US20170091447A1
公开(公告)日：2017-03-30
申请号：US15264672
申请日：2016-09-14
申请人： International Business Machines Corporation
发明人： Omer Y. Boehm , Eitan D. Farchi , Oded Margalit , Yousef Shajrawi , Michael Vinov
IPC分类号： G06F21/54 , G06F12/06
CPC分类号： G06F21/55 , G06F3/0623 , G06F3/064 , G06F3/0673 , G06F12/0646 , G06F21/52 , G06F21/54 , G06F21/566 , G06F21/60 , G06F2212/1052 , G06N99/005
摘要： Mitigating return-oriented programming attacks. Program code and associated components are received and loaded into memory. From the program code and associated components, a predetermined number of sequences of machine language instructions that terminate in a return instruction are selected. The sequences of machine language instructions include: machine language instruction sequences that are equivalent to a conditional statement “if-then-else return,” sequences of machine language instructions corresponding to known malicious code sequences, and sequences of machine language instructions corresponding to machine language instructions in known toolkits for assembling malicious code sequences. For each selected machine language instruction sequence, memory blocks containing the selected machine language instruction sequence are rearranged using address space layout randomization (ASLR); then, upon expiration of an expected time interval required to locate the selected machine language instruction sequence by inspecting the rearranged memory blocks, the rearranging is repeated, thereby mitigating ROP attacks.

7. 发明授权

US09665710B2 Mitigating ROP attacks 有权
公开(公告)号：US09665710B2
公开(公告)日：2017-05-30
申请号：US15264672
申请日：2016-09-14
申请人： International Business Machines Corporation
发明人： Omer Y. Boehm , Eitan D. Farchi , Oded Margalit , Yousef Shajrawi , Michael Vinov
IPC分类号： G06F11/00 , G06F21/54 , G06F12/06
CPC分类号： G06F21/55 , G06F3/0623 , G06F3/064 , G06F3/0673 , G06F12/0646 , G06F21/52 , G06F21/54 , G06F21/566 , G06F21/60 , G06F2212/1052 , G06N99/005
摘要： Mitigating return-oriented programming attacks. Program code and associated components are received and loaded into memory. From the program code and associated components, a predetermined number of sequences of machine language instructions that terminate in a return instruction are selected. The sequences of machine language instructions include: machine language instruction sequences that are equivalent to a conditional statement “if-then-else return,” sequences of machine language instructions corresponding to known malicious code sequences, and sequences of machine language instructions corresponding to machine language instructions in known toolkits for assembling malicious code sequences. For each selected machine language instruction sequence, memory blocks containing the selected machine language instruction sequence are rearranged using address space layout randomization (ASLR); then, upon expiration of an expected time interval required to locate the selected machine language instruction sequence by inspecting the rearranged memory blocks, the rearranging is repeated, thereby mitigating ROP attacks.

8. 发明申请

US20150261649A1 METHOD FOR PERFORMANCE MONITORING AND OPTIMIZATION VIA TREND DETECTION AND FORECASTING 有权
标题翻译：通过趋势检测和预测进行性能监测和优化的方法
公开(公告)号：US20150261649A1
公开(公告)日：2015-09-17
申请号：US14207647
申请日：2014-03-13
申请人： International Business Machines Corporation
发明人： Omer Y. Boehm , Anat Hashavit , Roy Levin , Yousef Shajrawi
IPC分类号： G06F11/34
CPC分类号： G06F11/3466 , G06F11/008 , G06F11/0706 , G06F11/0754 , G06F11/3409 , G06F2201/815 , G06F2201/86 , G06F2201/865
摘要： A method for identifying trends in system faults. During a generating stage, monitoring via a software based performance monitoring unit, a state of a server on a network and generating hardware or software performance information which indicate system faults of the server. During an analysis stage including, creating a dataset from the hardware or software performance information and isolating events from the dataset and categorizing each of the isolated events into a type, each type representing one application program call return. For each event in the dataset, assigning a trend score which decays with time such that recent events receive greater weight in the assigning than less recent events. Finally, performing one or more of: outputting a notification of the trend score, utilizing an optimization unit or triggering operation of a fault system handler for the event, when the trend score is above a threshold.
摘要翻译：一种识别系统故障趋势的方法。在生成阶段，通过基于软件的性能监视单元的监视，网络上的服务器的状态，以及生成指示服务器的系统故障的硬件或软件性能信息。在分析阶段，包括从硬件或软件性能信息创建数据集，并从数据集中隔离事件并将每个隔离事件分类为一种类型，每种类型表示一个应用程序调用返回。对于数据集中的每个事件，分配趋势分数随着时间的推移而衰减，使得最近的事件在分配中比最近的事件收到更大的权重。最后，当趋势得分高于阈值时，执行以下各项中的一个或多个：输出趋势分数的通知，利用优化单元或事件的故障系统处理程序的触发操作。

9. 发明授权

US10152592B2 Compiler assisted protection against arbitrary code execution 有权
公开(公告)号：US10152592B2
公开(公告)日：2018-12-11
申请号：US14965939
申请日：2015-12-11
申请人： International Business Machines Corporation
发明人： Omer Y. Boehm , Yousef Shajrawi
IPC分类号： G06F21/00 , G06F21/54 , G06F3/06 , G06F21/51
摘要： A method, computer program product, and computer system are provided. A processor receives an executable file for execution by an operating system, where the executable file includes a plurality of sections in a first order. A processor determines a second order that indicates a loading order for the plurality of sections, where the second order is distinct from the first order. A processor loads the plurality of sections of the executable file into a plurality of locations in memory of a device based on the second order. A processor resolves one or more memory references for the plurality of sections based on the plurality of locations in memory. A processor executes the plurality of sections of the executable file in the plurality of locations in memory.

10. 发明授权

US09734329B2 Mitigating ROP attacks 有权
公开(公告)号：US09734329B2
公开(公告)日：2017-08-15
申请号：US15132739
申请日：2016-04-19
申请人： International Business Machines Corporation
发明人： Omer Y. Boehm , Eitan D. Farchi , Oded Margalit , Yousef Shajrawi , Michael Vinov
IPC分类号： G06F11/00 , G06F21/55 , G06N99/00
CPC分类号： G06F21/55 , G06F3/0623 , G06F3/064 , G06F3/0673 , G06F12/0646 , G06F21/52 , G06F21/54 , G06F21/566 , G06F21/60 , G06F2212/1052 , G06N99/005
摘要： Mitigating return-oriented programming attacks. From program code and associated components needed by the program code for execution, machine language instruction sequences that may be combined and executed as malicious code are selected. A predetermined number of additional copies of each of the selected machine language instruction sequences are made, and the additional copies are marked as non-executable. The machine language instruction sequences and the non-executable copies are distributed in memory. If a process attempts to execute a machine language instruction sequence that has been marked non-executable, the computer may initiate protective action.

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式