Sensor for detecting and eliminating inter-process memory breaches in multitasking operating systems

Abstract

The invention relates to a method for detecting and eliminating SCR breach operations by a second party within the memory space allocated to a first party, in a multi-tasking system, which comprises: (a) pre-recording by the first party within a knowledge base the structure and/or behavior of an SCR stack; (b) implanting within the SCR stack a dedicated SCR for reporting on the structure and/or behavior of said SCR stack when the SCR stack is activated; (c) when the SCR stack is activated, comparing the data reported by the dedicated SCR with the pre-recorded stack structure and/or behavior; (d) whenever non-matching in the structure and/or behavior is found, ceasing the activity of the activated stack, and alerting.

1. A security method for detecting malicious inter-process memory breaches in a computer using a multi-tasking operating system and having a memory divisible into memory spaces with the memory including a plurality of shared code resource (SCR) stacks, each stack including a plurality of SCRs that while being executed for carrying out the various demands of a plurality of program processes, during computer operation, are organized in specific chain-like structures with specific behaviors and with boundaries between memory spaces for said program processes but with a common physical memory space for a SCR stack, said computer, when carrying out a program process, having the capability of extending an SCR stack by at least one of adding and replacing at least one SCR to the organized chain-like structure of the SCR stack and modifying the SCR stack's behavior, said security method comprising the steps of:
 (a) creating and storing a knowledge base that is comprised of structure and/or behavior information of each SCR stack during its execution in the memory of the computer; 
 (b) selecting for continuous monitoring an SCR stack which is being activated and executed by the computer operating system; 
 (c) implanting a dedicated SCR within said selected and activated SCR stack; 
 (d) monitoring said selected and activated SCR stack while it is being executed in memory via said dedicated SCR implanted in said selected and activated SCR stack to determine at least one of its structure and behavior; 
 (e) generating a report by said dedicated SCR in said selected and activated SCR stack while said selected and activated SCR stack is activated and executing, said report being indicative of at least one of the structure and behavior of said selected and activated SCR stack; 
 (f) transmitting said report for comparison with said stored knowledge base; 
 (g) comparing the indications of said transmitted report with said knowledge base; 
 (h) ceasing the activity and execution of said selected and activated SCR stack responsive to any non-matching detected between the indications of said report and said knowledge base to stop any hostile activity resulting in violation of the authenticity, structure and/or behavior of said SCR stack; and 
 (i) issuing an alert indicative of the hostile activity responsive to ceasing the activity and execution of said selected and activated SCR stack according to step (h). 
 
     
     
       2. Method according to  claim 1  wherein the knowledge base includes at least a list of all of the SCRs within the SCR stack, and the last date of their updating. 
     
     
       3. Method according to  claim 1  wherein step (g) comprises using a computer software code to compare SCR stack structure with the expected structure, the comparison comprising at least one of verifying one of the number of SCRs within the activated SCR stack, verifying the chain order of the SCRs within the SCR stack, verifying the time-stamps of the SCRs within the activated SCR stack, verifying the names of the SCRs within the activated SCR stack, verifying a signature of each SCR within the activated SCR stack, verifying the number of bits of each SCR within the activated SCR stack, verifying a checksum of each SCR within the activated SCR stack, verifying the physical path and name of each SCR within the activated SCR stack, verifying the duration of performance of the SCR stack, and verifying the duration of performance of each SCR within the SCR stack. 
     
     
       4. Method according to  claim 1  wherein step (g) comprises using a computer software code to compare SCR stack behavior with the expected behavior, the comparison comprising at least one of verifying the I/O devices to which a communication is made when the stack is activated by a specific process, and verifying the I/O addresses to which a communication is made when the stack is activated by a specific process. 
     
     
       5. Method according to  claim 1  wherein at least one of the SCRs in the activated SCR stack is a Dynamic Link Library (DLL). 
     
     
       6. Method according to  claim 1 , including the step of providing software code for controlling the dedicated SCR, wherein said code is a self learning code, which is based on self learned rules. 
     
     
       7. A security apparatus for detecting malicious inter-process memory breaches in a computer using a multi-tasking operating system and having a memory divisible into memory spaces with the memory including a plurality of shared code resource (SCR) stacks, each stack including a plurality of SCRs that while being executed for carrying out the various demands of a plurality of program processes, during computer operation, are organized in specific chain-like structures with specific behaviors and with boundaries between memory spaces for said program processes but with a common physical memory space for a SCR stack, said computer, when carrying out a program process, having the capability of extending an SCR stack by at least one of adding and replacing at least one SCR to the organized chain-like structure of the SCR stack and modifying the SCR stack's behavior, said security apparatus comprising:
 (a) a knowledge base, accessible to the computer, that is comprised of structure and/or behavior information of each SCR stack during its execution in the memory of the computer; 
 (b) a probe, executable by the computer, in a form of an SCR that is implanted within a selected and activated SCR stack for monitoring said selected and activated SCR stack while the stack is being executed in memory and for generating a report indicative of at least one of the structure and behavior of said selected and activated SCR stack; 
 (c) a sensor for receiving said report and for comparing indications relating to at least one of the structure and behavior of said selected and activated SCR stack with said stored knowledge base; 
 (d) means for ceasing the activity and execution of said selected and activated SCR stack responsive to any non-matching detected between the indications of said report and said knowledge base to stop any hostile activity resulting in violation of the authenticity, structure and/or behavior of said SCR stack; and 
 (e) means for issuing an alert indicative of the hostile activity responsive to ceasing the activity and execution of said selected and activated SCR stack. 
 
     
     
       8. Apparatus according to  claim 7 , which comprises a separate probe implanted within each selected SCR stack, and a common sensor receiving the report from one or more of the said implanted probes. 
     
     
       9. Apparatus according to  claim 7  wherein the knowledge base includes at least a list of all of the SCRs within the SCR stack, and the last date of their updating. 
     
     
       10. Apparatus according to  claim 7  including means for executing computer software code to compare an SCR stack structure with the expected structure stored in the knowledge base for a particular SCR stack. 
     
     
       11. Apparatus according to  claim 7  including means for executing a computer software code to compare SCR stack behavior with the expected behavior stored in the knowledge base for a particular SCR stack. 
     
     
       12. Apparatus according to  claim 7  wherein at least one of the SCRs is a Dynamic Link Library (DLL). 
     
     
       13. Apparatus according to  claim 7 , wherein said sensor includes software code that is a self learning code, which is based on self learned rules. 
     
     
       14. A non-transitory tangible computer readable medium having stored thereon, computer-executable instructions that, if executed by a computer, cause the computer to perform operations comprising:
 implanting a dedicated shared code resource (SCR) within an SCR stack, wherein the SCR stack is configured to be executable by the computer, wherein the SCR stack comprises one or more SCRs, and wherein the SCR stack has an associated structure and an associated behavior; and   upon the computer activating the dedicated SCR, comparing at least one member selected from the group consisting of structure of the SCR stack and behavior of the SCR stack with information of the SCR stack stored in a knowledge base.   
     
     
       15. The medium of claim 14, wherein implanting the dedicated SCR comprises requesting that an operating system executing on the computer insert the SCR into the SCR stack. 
     
     
       16. The medium of claim 14, wherein comparing the structure comprises verifying at least one member selected from the group consisting of
 a number of SCRs within the SCR stack,   a chain order of the SCRs within the SCR stack,   timestamps of the SCRs within the SCR stack,   names of the SCRs within the SCR stack,   signatures of the SCRs within the SCR stack,   a number of bits of the SCRs within the SCR stack,   a checksum of the SCRs within the SCR stack, and   a physical path and name of the SCRs within the SCR stack.   
     
     
       17. The medium of claim 14, wherein comparing the behavior comprises verifying at least one member selected from the group consisting of
 a duration of performance of the SCRs within the SCR stack,   a duration of performance of the SCR stack,   I/O devices to which a communication is made when the SCR stack is activated, and   I/O addresses to which a communication is made when the stack is activated.   
     
     
       18. The medium of claim 14, wherein the dedicated SCR is executed in response to activating the SCR stack. 
     
     
       19. The medium of claim 18, wherein the dedicated SCR is implanted at the beginning of the chain. 
     
     
       20. The medium of claim 14, wherein the one or more SCRs within the SCR stack are organized in a chain. 
     
     
       21. The medium of claim 14, wherein at least one of the one or more SCRs within the SCR stack is a Dynamic Link Library (DLL). 
     
     
       22. A security apparatus comprising:
 a knowledge base, encoded in memory accessible to a computer, comprising at least one of structure and behavior information of a shared code resource (SCR) stack, wherein the SCR stack comprises one or more SCRs;   a probe, executable by the computer, implanted within the SCR stack for reporting at least one information of the SCR stack selected from the group consisting of structure information and behavior information when the SCR stack is activated; and   a comparing unit for comparing the information reported by the probe with the information recorded in the knowledge base.   
     
     
       23. The security apparatus of claim 22, wherein the structure information comprises at least one member selected from the group consisting of
 a number of SCRs within the SCR stack,   a chain order of the SCRs within the SCR stack,   timestamps of the SCRs within the SCR stack,   names of the SCRs within the SCR stack,   signatures of the SCRs within the SCR stack,   a number of bits of the SCRs within the SCR stack,   a checksum of the SCRs within the SCR stack, and   a physical path and name of the SCRs within the SCR stack.   
     
     
       24. The security apparatus of claim 22, wherein the behavior information comprises at least one member selected from the group consisting of
 a duration of performance of the SCRs within the SCR stack,   a duration of performance of the SCR stack,   I/O devices to which a communication is made when the SCR stack is activated, and   I/O addresses to which a communication is made when the stack is activated.   
     
     
       25. The security apparatus of claim 22, wherein the one or more SCRs within the SCR stack are organized in a chain. 
     
     
       26. The security apparatus of claim 25, wherein the probe is implanted at the beginning of the chain. 
     
     
       27. The security apparatus of claim 22, wherein at least one of the one or more SCRs within the SCR stack is a Dynamic Link Library (DLL). 
     
     
       28. The security apparatus of claim 22, further comprising a decision unit for initiating an operation in response to the comparing unit detecting at least one member selected from the group consisting of an abnormal structure and an abnormal behavior. 
     
     
       29. A system comprising:
 means, including a non-transitory tangible computer readable medium having computer executable instructions stored thereon, for reporting at least one information of a shared code resource (SCR) stack selected from the group consisting of structure information and behavior information when the SCR stack is activated; and   means for comparing the reported information with at least one information of the SCR stack stored in a knowledge base selected from the group consisting of structure information and behavior information, wherein the means for comparing include means for implanting a dedicated SCR within the SCR stack.   
     
     
       30. The system of claim 29, wherein the structure information comprises at least one member selected from the group consisting of
 a number of SCRs within the SCR stack,   a chain order of the SCRs within the SCR stack,   timestamps of the SCRs within the SCR stack,   names of the SCRs within the SCR stack,   signatures of the SCRs within the SCR stack,   a number of bits of the SCRs within the SCR stack,   a checksum of the SCRs within the SCR stack, and   a physical path and name of the SCRs within the SCR stack.   
     
     
       31. The system of claim 29, wherein the behavior information comprises at least one member selected from the group consisting of
 a duration of performance of the SCRs within the SCR stack,   a duration of performance of the SCR stack,   I/O devices to which a communication is made when the SCR stack is activated, and   I/O addresses to which a communication is made when the stack is activated.   
     
     
       32. The system of claim 29, wherein the SCR stack comprises one or more SCRs organized in a chain. 
     
     
       33. The system of claim 29, wherein at least one of the one or more SCRs is a Dynamic Link Library (DLL).