Detecting shellcode that modifies IAT entries

[0001] 1. Field of the Invention

[0002] The present invention relates to the protection of computer systems. More particularly, the present invention relates to detection of malicious code.

[0003] 2. Description of Related Art

[0004] Intrusion detection systems are widely used on computer systems to protect the computer systems from exploitation by malicious code, commonly termed shellcode. When structures utilized by the intrusion detection systems themselves are compromised, the malicious code can evade detection by the intrusion detection systems and exploit the computer systems.

[0005] In accordance with one embodiment, a method includes generating a critical imported functions table including an address in memory of a critical imported function. A call to the critical imported function is hooked, and execution of the call is redirected from a current process import address table (IAT) entry in a current process IAT to a corresponding critical imported functions table entry in the critical imported functions table. The current process IAT corresponding to the critical imported function is evaluated to determine whether a malicious code evasion attempt is detected. If an evasion attempt is detected, a user and/or system administrator is notified. Optionally protective action is taken, such as saving a copy of the current process IAT for later analysis.

[0006] Embodiments in accordance with the present invention are best understood by reference to the following detailed description when read in conjunction with the accompanying drawings.

[0013] Common reference numerals are used throughout the drawings and detailed description to indicate like elements.

[0014] Executable applications used on Windows® operating systems conventionally utilize the Portable Executable (PE) file format. The PE file format is composed of multiple data structures that define an executable file. The PE file format is documented in Windows® NT and Windows® 2000 software developer's kits (SDKs) (available from Microsoft, Inc. of Redmond, Wash.) and is well-known to those of skill in the art.

[0015] When an executable application uses code or data from shared libraries, e.g., dynamically linked libraries (DLLs), this is termed importing functions. When an executable application, e.g., a PE file, is loaded, the Windows® (hereinafter Windows) operating system imports the shared libraries that the application uses and maps them into the process address space of the application. As Windows operating systems utilize virtual memory management, the addresses in memory at which the functions are located are not static.

[0016] Within a PE file, there is an array of data structures, one per imported shared library, and each of these data structures gives the name of the imported shared library and points to an array of function pointers, also termed herein entries. The array of entries is known as the import address table (IAT). Windows operating systems utilize the IAT to map an imported function to an address in memory. When a process first starts up, typically the IAT is a mirror of the import lookup table, and is later filled in with runtime addresses.

[0017] Each imported function has a particular location in an IAT where its corresponding entry is written. Herein an entry in an IAT can be a function pointer identifying a path to the location of the imported function in memory, for example, a jump instruction to thunk code that is used to determine the address of the imported function, or can be the actual address of the imported function in memory, for example, an offset.

[0018] In some applications, the IAT entry for an imported function is resolved to the address of the imported function by the Windows operating system when the application is loaded, e.g., at start up. This type of binding is termed herein non-lazy binding.

[0019] In other applications, the IAT entry for an imported function is not resolved to the address of the imported function by the Windows operating system when the application is loaded. Instead the IAT entry is a function pointer, such as a jump instruction, to intermediate code termed thunk code present in the process address space. The thunk code is used to resolve the address of the imported function at the time the imported function is called and the function pointer is overwritten with the resolved address. This type of binding is termed herein lazy binding.

[0020] Typically when a host intrusion detection system (HIDS) application is implemented in a computer system using a Windows operating system, the HIDS application utilizes the operating system APIs to access selected imported functions of the shared libraries, for example, “NtQueryvirtualMemory” in ntdll.dll or “Virtual Query” in kernel32.dll, and perform security analyses. More particularly, the HIDS application is executing within the context, e.g., the address space, of whatever process it is trying to protect. Thus, the HIDS application accesses imported functions it needs through the process IAT(s).

[0021] If malicious shellcode, herein termed malicious code, were to change the IAT entries used by the HIDS application, an attacker could redirect use of the imported functions to functions supplied by the malicious code and evade detection. In particular, an attacker could control the return value of imported functions and cause a HIDS application to assume execution is safe when in fact the computer system is being exploited, for example, a buffer overflow has occurred.

[0022] Referring generally to FIGS. 2A and 2B, in one embodiment, at start up of a process protected by a HIDS application, the initial process IAT(s) associated with a process are located (operation 204) and initial process IAT entries corresponding to critical imported functions are resolved and written into a critical imported functions table that is dynamically allocated and marked read-only (operation 206). Each initial process IAT that includes a critical imported function is copied as a reference copy IAT that is dynamically allocated and marked read-only (operation 208). Each entry in the reference copy IAT is resolved to the address of the corresponding function and written into a resolved copy IAT that is dynamically allocated and marked read-only (operation 210). The critical imported functions are hooked, for example by hooking a system call table utilized by the process (operation 212). A call to a critical imported function is stalled (operation 214) and execution of the call is redirected to a corresponding entry in the critical imported functions table, rather than a corresponding entry in a current process IAT (operation 216). The current process IAT is evaluated to determine whether a malicious code evasion attempt is detected (operation 218), and if so, a user and/or system administrator is notified (operation 220). Optionally, protective action is taken (operation 222), such as saving a copy of the current process IAT for later evaluation.

[0023] Embodiments in accordance with the invention, redirect calls to functions that a HIDS application depends upon for data integrity to a critical imported functions table that was resolved at start up, dynamically allocated, and marked read only rather than to a current process IAT that may have been modified by malicious code attempting to evade detection. The redirection is further used as an opportunity to evaluate the corresponding current process IAT for changes that are indicative of malicious code attempting to evade detection.

[0024] Herein, in one embodiment, malicious code is defined as any computer program, module, set of modules, or code that enters a computer system environment without an authorized user's knowledge and/or without an authorized user's consent. A computer virus that modifies process IAT entries to avoid detection is one example of a malicious code.

[0025] FIG. 1 is a diagram of a client-server system 100 that includes a detection application 106 executing on a host computer system 102 in accordance with one embodiment of the present invention. Host computer system 102, can be a stand-alone computer system, such as a personal computer or workstation, as illustrated in FIG. 1. Host computer system 102, e.g., a first computer system, can also be part of a client-server configuration that is also illustrated in FIG. 1 in which computer system 102 interacts with a server computer system 130, e.g., a second computer system, via a network 126. Network 126 can be any network or network system that is of interest to a user, for example, the Internet.

[0026] Detection application 106 is described herein as executed on host computer system 102, however, in light of this disclosure, those of skill in the art can understand that the description is applicable to a client-server system as well. Host computer system 102 typically includes a central processing unit (CPU) 108, hereinafter processor 108, an input/output (I/O) interface 110, an operating system 104, and a memory 112.

[0027] Host computer system 102 may further include standard devices, such as a keyboard 116, a mouse 118, a printer 120, and a display device 122, as well as, one or more standard input/output (I/O) devices 124, such as a compact disk (CD) or DVD drive, floppy disk drive, or other digital or waveform port for inputting data to and outputting data from host computer system 102. In one embodiment, memory 112 includes a main memory, as well as any supplemental memories, and includes executable areas, data storage areas, and any memory areas needed by host computer system 102.

[0028] In one embodiment, detection application 106 is loaded into host computer system 102 via I/O device 124, such as from a CD, DVD or floppy disk containing detection application 106. In other embodiments, such as client-server embodiments, detection application 106 can be downloaded into host computer system 102 from server computer system 130 via network 126. Server computer system 130 can further include: a network interface 138 for communicating with network 126; a memory 136; a processor 134; and, a display device 132. In various embodiments, network interface 138 and I/O interface 110 include analog modems, digital modems, or a network interface card.

[0029] In FIG. 1, host computer system 102 is also coupled to an hacker computer system 128, by network 126, from which malicious code may be received, such as via a file containing malicious code. In one embodiment, hacker computer system 128 is similar to host computer system 102, for example, includes a central processing unit, an input/output (I/O) interface and a memory. Hacker computer system 128 may further include standard devices like a keyboard, a mouse, a printer, a display device, and an I/O device(s). The various hardware components of hacker computer system 128 are not illustrated to avoid detracting from the principles of the invention.

[0030] In the present embodiment, detection application 106 is stored in memory 112 of host computer system 102 and executed on host computer system 102. The particular type and configuration of host computer system 102, server computer system 130, and hacker computer system 128 are not essential to this embodiment of the present invention.

[0031] FIG. 2 is a key to FIGS. 2A and 2B that illustrate a flow diagram of a method 200 implemented by detection application 106 in accordance with one embodiment of the invention. In various embodiments, detection application 106 can be implemented independently or as part of another application, such as a host intrusion detection system (HIDS) application. For purposes of description, detection application 106 is described herein as implemented as part of a host intrusion detection system application, e.g., HIDS application 114 (FIG. 1), implemented on computer system 102. Referring now to FIGS. 1 and 2 together, in one embodiment, execution of detection application 106 by processor 108 results in the operations of method 200 as described below.

[0032] In the present embodiment, when HIDS application 114 receives notification that a new process, that is to be protected by HIDS application 114, is created, detection application 106 including method 200 is loaded while the process is starting up and method 200 is entered at an ENTER operation 202. From ENTER operation 202, processing transitions to a LOCATE INITIAL PROCESS IAT(s) operation 204.

[0033] In LOCATE INITIAL PROCESS IAT(s) operation 204, at start up, i.e., a first time, the initial process IAT(s) are located. For example, in one embodiment, the address(es) of the initial process IAT(s) are determined from the PE directory structure of a process that HIDS application 114 is operating in. Herein an initial process IAT is an IAT of the process at start up of the process and prior to any modifications. From LOCATE INITIAL PROCESS IAT(s) operation 204, processing transitions to a GENERATE CRITICAL IMPORTED FUNCTIONS TABLE operation 206.

[0034] In GENERATE CRITICAL IMPORTED FUNCTIONS TABLE operation 206, on start up, a critical imported functions table including the resolved addresses of critical imported functions utilized by HIDS application 114 is generated. In particular, in one embodiment, on start up, IAT entries in initial process IATs corresponding to critical imported functions are resolved to the corresponding addresses in memory of the critical imported functions and are written to a critical imported functions table, for example, a HIDS_DEPENDENT_FUNCS table. In one embodiment, the critical imported functions table is dynamically allocated, e.g., in either stack or heap, on host computer system 102 and the critical imported functions table is marked read-only. Thus in one embodiment, the critical imported functions table is at an address not fixed in memory, e.g., is a dynamically allocated address, and is marked read-only to prevent it from being easily modified, for example, by malicious code.

[0035] Herein a critical imported function is any imported function that HIDS application 114 utilizes and depends upon its data integrity. Examples of critical imported functions include “NtQueryvirtualMemory” in ntdll.dll or “Virtual Query” in kernel32.dll, however, fewer, more, or different critical imported functions can be selected. FROM GENERATE CRITICAL IMPORTED FUNCTIONS TABLE operation 206, processing transitions to a GENERATE REFERENCE COPY IAT(s) operation 208.

[0036] In GENERATE REFERENCE COPY IAT(s) operation 208, at start up, each initial process IAT that includes a critical imported function is copied and designated a reference copy IAT, for example, an IAT_ORIGINAL_COPY. In one embodiment, the reference copy IAT(s) are dynamically allocated, e.g., in either stack or heap, and are marked read-only. Thus in one embodiment, a reference copy IAT is a copy of an initial process IAT, i.e., in the start up state, that includes a critical imported function. From GENERATE REFERENCE COPY IAT(s) operation 208, processing transitions to a GENERATE RESOLVED COPY IAT(s) operation 210.

[0037] In GENERATE RESOLVED COPY IAT(s) operation 210, each IAT entry in a reference copy IAT is resolved to the corresponding address in memory of the critical imported function and written to a corresponding resolved copy IAT, for example, an IAT_RESOLVED_COPY. In one embodiment, the resolved copy IAT(s) are dynamically allocated, e.g., in either stack or heap, and marked read-only. From GENERATE RESOLVED COPY IAT(s) operation 210, processing transitions to a HOOK CRITICAL IMPORTED FUNCTION(s) operation 212.

[0038] In HOOK CRITICAL IMPORTED FUNCTION(s) operation 212, the critical imported function(s) utilized by HIDS application 114 are hooked so that a call to, or other invocation of, a critical imported function is redirected from a corresponding entry in a current process IAT to detection application 106, e.g., to a hook module of detection application 106. As is well known to those of skill in the art, hooking a function allows a process to intercept calls to, or the invocation of, a function on a program wide or operating system wide basis prior to execution. In the present embodiment, at least one critical imported function is hooked. Herein a current process IAT is an IAT of the process after start up of the application and may include modified entries.

[0039] For example, in one embodiment, a system call table utilized by operating system 104 is hooked so that calls to, or other invocations of, critical imported functions are redirected to detection application 106, e.g., to a hook module of detection application 106. In particular, in one embodiment, pointers in the system call table corresponding to the critical imported functions are overwritten with new pointers to detection application 106, e.g., to a hook module of detection application 106.

[0040] When the critical imported function(s) are hooked, method 200 waits, for example, in a stand-by mode, until a call to, or other invocation of, a hooked critical imported function is originated and redirected to detection application 106, e.g., to a hook module of detection application 106. From HOOK CRITICAL IMPORTED FUNCTION(s) operation 212, processing transitions to a STALL CALL TO CRITICAL IMPORTED FUNCTION operation 214.

[0041] In STALL CALL TO CRITICAL IMPORTED FUNCTION operation 214, a call to, or other invocation of, a hooked critical imported function is stalled, i.e., is prevented from reaching the operating system. In one embodiment, the call is stalled by detection application 106, e.g., by a hook module of detection application 106. From STALL CALL TO CRITICAL IMPORTED FUNCTION operation 214, processing transitions to a REDIRECT CALL TO CRITICAL IMPORTED FUNCTION USING CRITICAL IMPORTED FUNCTIONS TABLE operation 216.

[0042] In REDIRECT CALL TO CRITICAL IMPORTED FUNCTION USING CRITICAL IMPORTED FUNCTIONS TABLE operation 216, the call to, or other invocation of, the critical imported function is made through the critical imported functions table. Thus, rather than the critical imported function being accessed through a corresponding IAT entry in a corresponding current process IAT, which may have been modified by malicious code, the critical imported function is accessed through a corresponding entry in the critical imported functions table generated in operation 206.

[0043] In this way HIDS application 114 utilizes an address of the critical imported function that was resolved at start up, dynamically allocated, and marked read only, i.e., in the critical imported functions table, and is thus assumed less susceptible to modification by malicious code.

[0044] FIG. 5 is a diagram 500 illustrating calling a critical imported function 520 using a critical imported functions table 516 in accordance with one embodiment of the invention. Referring now to FIG. 5, in one embodiment, in diagram 500 a call 506 to a critical imported function 520 is originated from a call module 504 within a process address space 502 of a process protected by HIDS application 114.

[0045] Call 506 is communicated to a hooked system call table 508 that was earlier hooked by detection application 106. Rather than accessing critical imported function 520 through a corresponding IAT entry A 512 of a current process IAT 510, call 506 is redirected to detection application 106, e.g., to a hook module 514. Call 506 is stalled and redirected to an ADDR A 518 (a resolved address of critical imported function 520) in critical imported functions table 516. In one embodiment, call 506 is stalled by detection application 106 and detection application 106, e.g., hook module 514, originates a call to critical imported function 520 using ADDR A 518 in critical imported functions table 516.

[0046] Referring back again to FIG. 2 and method 200, thus at operation 216, a call to a critical function, which HIDS application 114 depends upon for data integrity, is redirected from a current process IAT that may have been modified by malicious code attempting to evade detection to a critical imported functions table that was resolved at start up, dynamically allocated, and marked read only. From REDIRECT CALL TO CRITICAL IMPORTED FUNCTION USING CRITICAL IMPORTED FUNCTIONS TABLE operation 216, processing transitions to an EVASION ATTEMPT DETECTED IN CURRENT PROCESS IAT check operation 218.

[0047] In EVASION ATTEMPT DETECTED IN CURRENT PROCESS IAT check operation 218, the call redirection is further used as an opportunity to evaluate the corresponding current process IAT for changes that are indicative of malicious code attempting to evade detection. In one embodiment, the current process IAT associated with the critical imported function is analyzed to determine whether a malicious code evasion attempt is detected. One embodiment of a method for determining whether an evasion attempt is detected in the current process IAT associated with a critical imported function is further described with reference to FIGS. 3 and 4.

[0048] If an evasion attempt is not detected (“NO”), from EVASION ATTEMPT DETECTED IN CURRENT PROCESS IAT check operation 218, processing transitions to an EXIT operation 224 with processing exiting method 200. In some embodiments, rather than exiting method 200 at EXIT operation 224, processing returns to operation 214.

[0049] Alternatively, if an evasion attempt is detected (“YES”), from EVASION ATTEMPT DETECTED IN CURRENT PROCESS IAT check operation 218, processing transitions to a NOTIFY operation 220.

[0050] In NOTIFY operation 220, a user of host computer system 102 and/or a system administrator are notified that malicious code and/or an evasion attempt has been detected on host computer system 102. The user and/or system administrator can be notified using any one of a number of techniques, such as by using a pop up window, by writing to a file, and/or otherwise by logging the event. Further, a notification can be provided to a security center. From NOTIFY operation 220, processing transitions to an optional PROTECTIVE ACTION operation 222, directly to EXIT operation 224, or returns to operation 214, if optional PROTECTIVE ACTION operation 222 is not performed.

[0051] In optional PROTECTIVE ACTION operation 222, in one embodiment, a copy of the current process IAT is made and saved for analysis. In some embodiments, the copy of the current process IAT is dumped to a text file, or sent to a user, system administrator, and/or security center. In particular, as the code pages the current process. IAT entry now illegitimately points to may be specific to a particular exploit/worm, the copy of the current process IAT can be analyzed to uniquely identify the exploit or worm.

[0052] In one embodiment, the user is prompted for input prior to making and/or sending the copy of the current process IAT, e.g., the user is asked for permission to take the protective action. From optional PROTECTIVE ACTION operation 222, processing transitions to EXIT operation 224, or returns to operation 214.

[0053] FIG. 3 illustrates a flow diagram of a method 300 for determining whether an evasion attempt is detected in a current process IAT in operation 218 of FIG. 2 in accordance with one embodiment of the invention. The operations of FIG. 3 and method 300 are described herein with reference to FIG. 6. FIG. 6 is a diagram 600 illustrating determining whether an evasion attempt is detected in a current process IAT in accordance with one embodiment of the invention.

[0054] Referring now to FIGS. 3 and 6 together, in one embodiment, method 300 is entered at ENTER operation 302 from operation 216 (FIG. 2), and processing transitions from ENTER operation 302 to a ENTRY IN CURRENT PROCESS IAT MATCH ENTRY IN REFERENCE COPY IAT check operation 304.

[0055] In ENTRY IN CURRENT PROCESS IAT MATCH ENTRY IN REFERENCE COPY IAT check operation 304, an entry in the current process IAT, i.e., a first entry, is compared to a corresponding entry in a reference copy IAT to determine whether the current process IAT entry has changed from the initial start up state. For example, in FIG. 6, IAT entry A 512 in current process IAT 510 is compared to IAT entry A 608 in reference copy IAT 606, which is a copy of the entry in the start up state.

[0056] In one embodiment, if the entry in the current process IAT matches the corresponding entry in the reference copy IAT (“YES”), it is assumed that there has been no change made to the entry in the current process IAT from the start up state. Thus, in FIG. 6, if IAT entry A 512 matches IAT entry A 608, IAT entry A 512 has not changed from the initial start up state. Consequently, it is assumed that malicious code has not modified the entry in the current process IAT, for example to evade detection by HIDS application 114. From ENTRY IN CURRENT PROCESS IAT MATCH ENTRY IN REFERENCE COPY IAT check operation 304, processing transitions to a LAST ENTRY IN CURRENT PROCESS IAT check operation 306.

[0057] In LAST ENTRY IN CURRENT PROCESS IAT check operation 306, a determination is made whether the entry in the current process IAT evaluated in check operation 304 is the last entry in the current process IAT, e.g., whether a next entry is present for evaluation in the current process IAT. In FIG. 6, current process IAT 510 includes IAT ENTRY B through IAT ENTRY N, and thus IAT entry A 512 is not the last entry in current process IAT 510. If the entry evaluated in check operation 304 is not the last entry in the current process IAT (“NO”), processing transitions from LAST ENTRY IN CURRENT PROCESS IAT check operation 306, and returns to check operation 304 with the next entry in the current process IAT for evaluation.

[0058] Otherwise, if the entry evaluated in check operation 304 is the last entry in the current process IAT (“YES”), e.g., IAT entry B through IAT entry N in current process IAT 510 of FIG. 6 were not present, processing transitions from LAST ENTRY IN CURRENT PROCESS IAT check operation 306 to operation 308 with processing exiting method 300 and transitioning to EXIT operation 224 of process 200 (FIG. 2).

[0059] Referring again to ENTRY IN CURRENT PROCESS IAT MATCH ENTRY IN REFERENCE COPY IAT operation 304, alternatively, if the entry in the current process IAT does not match the corresponding entry in the reference copy IAT (“NO”), it is assumed there the entry in the current process IAT has changed from the start up state. For example, in FIG. 6, if IAT entry A 512 did not match IAT entry A 608, IAT entry A 512 has changed from the initial start up state. Further evaluation is needed to determine whether the change is indicative of a malicious code evasion attempt. From ENTRY IN CURRENT PROCESS IAT MATCH ENTRY IN REFERENCE COPY IAT check operation 304, processing transitions to KNOWN STATE check operation 310.

[0060] In KNOWN STATE check operation 310, the changed entry in the current process IAT is evaluated to determine whether it is a known state. In one embodiment, a changed entry in a current process IAT is a known state if it identifies a location within the address space allocated to the current process or if it matches a corresponding entry in the resolved copy IAT. Otherwise, the changed entry in the current process IAT is determined not to be to a known state and indicative of a malicious code evasion attempt. One embodiment of a method for determining whether a changed entry in a current process IAT is a known state is further described herein with reference to FIG. 4 and method 400.

[0061] If the changed entry in the current process IAT is determined to be to a known state, i.e., not indicative of malicious code (“YES”), processing transitions from KNOWN STATE check operation 310 to LAST ENTRY IN CURRENT PROCESS IAT check operation 306 as earlier described.

[0062] Alternatively, if the changed entry in the current process IAT is determined not to be a known state, i.e., indicative of malicious code (“NO”), a determination is made that a malicious code evasion attempt is detected in the current process IAT. From KNOWN STATE operation 310, processing exits method 300 at operation 312 and transitions to operation 220 (FIG. 2). Thus in one embodiment, when a changed entry in a current process IAT is found that is not a known state, i.e., is indicative of a malicious code evasion attempt, any remaining entries in the current process IAT are not checked, and processing returns to method 200.

[0063] In an alternative embodiment, each entry in the current process IAT is checked prior to processing returning to method 200. Thus, rather than processing returning to method 200 at operation 312 when an evasion attempt is first detected, entries in the current process IAT that are not a known state, e.g., indicative a malicious code evasion attempt, are flagged and processing transitions to operation 306 until the last entry in the current process IAT is evaluated. If each of the entries in the current process IAT either match a corresponding entry in the reference copy IAT or are a known state, processing transitions to operation 224 as earlier described. Otherwise, if an entry in the current process IAT is flagged as not to a known state, processing transitions to operation 220 as earlier described.

[0064] FIG. 4 illustrates a flow diagram of a method 400 for determining whether a changed entry in a current process IAT is a known state in accordance with one embodiment of the invention. Referring now to FIGS. 4 and 6 together, in one embodiment, processing transitions to method 400 from operation 304 (FIG. 3) at an ENTER operation 402. From ENTER operation 402, processing transitions to an ADDRESS IN EXECUTABLE check operation 404.

[0065] In ADDRESS IN EXECUTABLE check operation 404, the entry in the current process IAT is evaluated to determine whether it identifies a location within the main executable image of the process in the process address space. In one embodiment, the entry in the current process IAT is read and a determination is made whether the entry identifies an address location, such as an offset, within the main executable image of the process, i.e., within the address space allocated to the executable file itself, not one that is imported. For example, in one embodiment, a determination is made whether the entry identifies an address location within a minimum/maximum address range allocated to the main executable image of the current process. The determination of an address range allocated to a main executable image of a process is well-known to those of skill in art and is not further described herein.

[0066] If the entry in the current process IAT identifies an address location within the address range allocated to the main executable image of the process, the entry in the current process IAT is determined to identify a location within the executable file of the process, otherwise, it is not determined to identify an address location within the executable file of the process.

[0067] If the current process IAT entry identifies a location within the main executable file image of the process (“YES”), it is assumed the location is associated with thunk code. Thus, the changed entry in the current process IAT is a known state and not indicative of malicious code, e.g., not indicative of an evasion attempt. For example, in FIG. 6, thunk A 604 is present in the process address space 502 allocated to the main executable image of the process and is used to resolve the address of the critical imported function, e.g., critical imported function 520. If IAT entry A 512 identifies the location of thunk A 604 in the process address space 502, IAT entry A 512 is a known state. From ADDRESS IN EXECUTABLE check operation 404, processing exits method 400 at operation 408 and transitions to operation 306 (FIG. 3).

[0068] Referring again to ADDRESS IN EXECUTABLE check operation 404, alternatively, if the entry in the current process IAT does not identify a location within the main executable file image of the process (“NO”), it is assumed the location is not associated with thunk code. Thus, the changed entry in the current process IAT is not a known state and indicative of malicious code, e.g., indicative of an evasion attempt. For example, in FIG. 6, malicious code 602 may be present at an address on host computer system 102 that is not within process address space 502. If IAT entry A 512 identifies the location of malicious code 602 that is not within process address space 502 allocated to the main executable image of the process, IAT entry A 512 is not a known state. From ADDRESS IN EXECUTABLE check operation 404, processing transitions to a MATCH RESOLVED ADDRESS check operation 406.

[0069] In MATCH RESOLVED ADDRESS check operation 406, the entry in current process IAT is evaluated to determine whether it matches a resolved address corresponding to the critical imported function. In one embodiment, the entry in the current process IAT is read and a determination is made whether the entry in the current process IAT matches a corresponding entry in a resolved copy IAT. For example, in FIG. 6 IAT entry A 512 in current process IAT 510 is compared to corresponding ADDR A 612 in resolved copy IAT 610.

[0070] If the entry in the current process IAT matches the corresponding entry in the resolved copy IAT entry, i.e., the resolved address of the critical imported function (“YES”), the entry in the current process IAT is determined to be a known state and is not indicative of malicious code, e.g., not indicative of an evasion attempt. In FIG. 6, if IAT entry A 512 matches ADDR A 612, IAT entry A 512 is determined to be a known state. From MATCH RESOLVED ADDRESS check operation 406, processing exits method 400 at operation 408 and transitions to operation 306 (FIG. 3) as earlier described.

[0071] Alternatively, if the entry in the current process IAT does not match a corresponding entry in a resolved copy IAT, i.e., the resolved address of the critical imported function (“NO”), the entry in the current process IAT is assumed not to identify a known state and is indicative of malicious code, e.g., is indicative of an evasion attempt. In FIG. 6, if IAT entry A 512 of current process IAT 510 does not match ADDR A 612, IAT entry A 512 is not determined to be a known state. From MATCH RESOLVED ADDRESS check operation 406, processing exits method 400 at operation 410 and transitions to operation 312 (FIG. 3).

[0072] Thus, in accordance with the invention, critical imported functions utilized by an application, such as a HIDS application, are hooked so that a call, or other invocation of, a critical imported function is redirected through a critical imported functions table rather than a current process IAT. The call redirection is further used as an opportunity to evaluate the corresponding current process IAT for changes that are indicative of malicious code attempting to evade detection. If an evasion attempt is detected in the current process IAT, a notification is provided to a user/system administrator and optionally protective action is taken, such as saving a copy of the current process IAT for later analysis.

[0073] Referring again to FIG. 1, detection application 106 is in computer memory 112. As used herein, a computer memory refers to a volatile memory, a non-volatile memory, or a combination of the two.

[0074] Although detection application 106 is referred to as an application, this is illustrative only. Detection application 106 should be capable of being called from an application, e.g., HIDS application 114, or the operating system, e.g., operating system 104.

[0075] In one embodiment, an application is generally defined to be any executable code. Moreover, those of skill in the art will understand that when it is said that an application or an operation takes some action, the action is the result of executing one or more instructions by a processor.

[0076] While embodiments in accordance with the present invention have been described for host computer and client-server configurations, embodiments of the present invention may be carried out using any suitable means and/or hardware configuration involving a personal computer, a workstation, a portable device, or a network of computer devices. Other network configurations other than client-server configurations, e.g., peer-to-peer, web-based, intranet, internet network configurations, are used in other embodiments.

[0077] Herein, a computer program product comprises a medium configured to store or transport computer readable code in accordance with an embodiment of the present invention. Some examples of computer program products are CD-ROM discs, DVDs, ROM cards, floppy discs, magnetic tapes, computer hard drives, and servers on a network. Further herein, a means for performing a particular function is accomplished using the appropriate computer-readable code and the related hardware necessary to performing the function.

[0078] As illustrated in FIG. 1, this medium may belong to the computer system itself. However, the medium also may be removed from the computer system. For example, detection application 106 may be stored in memory 136 that is physically located in a location different from processor 108. Processor 108 should be coupled to memory 136. This could be accomplished in a client-server system, or alternatively via a connection to another computer via modems and analog lines, or digital interfaces and a digital carrier line.

[0079] More specifically, in one embodiment, host computer system 102 and/or server computer system 130 is a portable computer, a workstation, a two-way pager, a cellular telephone, a digital wireless telephone, a personal digital assistant, a server computer, an Internet appliance, or any other device that includes components that can execute the detection functionality in accordance with at least one of the embodiments as described herein. Similarly, in another embodiment, host computer system 102 and/or server computer system 130 is comprised of multiple different computers, wireless devices, cellular telephones, digital telephones, two-way pagers, or personal digital assistants, server computers, or any desired combination of these devices that are interconnected to perform, the processes as described herein.

[0080] In view of this disclosure, the embodiments of the present invention can be implemented in a wide variety of computer system configurations. In addition, the embodiments of the present invention can be stored as different modules in memories of different devices.

[0081] For example, detection application 106 could initially be stored in server computer system 130, and then as necessary, a portion of detection application 106 could be transferred to host computer system 102 and executed on host computer system 102. Consequently, part of detection application 106 would be executed on processor 134 of server computer system 130, and another part would be executed on processor 108 of host computer system 102.

[0082] In yet another embodiment, detection application 106 is stored in memory 136 of server computer system 130. Detection application 106 is transferred over network 126 to memory 112 in host computer system 102. In this embodiment, network interface 138 and I/O interface 110 would include analog modems, digital modems, or a network interface card. If modems are used, network 126 includes a communications network, and detection application 106 is downloaded via the communications network. In view of this disclosure, those of skill in the art can implement various embodiments of the present invention in a wide-variety of physical hardware configurations using an operating system and computer programming language of interest to the user.

[0083] This disclosure provides exemplary embodiments of the present invention. The scope of the present invention is not limited by these exemplary embodiments. Numerous variations, whether explicitly provided for by the specification or implied by the specification or not, may be implemented by one of skill in the art in view of this disclosure.