Buffer overflow trap

Abstract

Aspects of the invention include an operating system executing on a processor receiving a write request from a program to write data to memory. The write request includes a virtual memory address and data. It is determined that the virtual memory address is not assigned to a physical memory address. Based on the determination, the unassigned virtual memory address is assigned to a physical memory address in an overflow memory. The data is written to the physical memory address in the overflow memory, and an indication of a successful write of the data is returned to the program. Future requests by the program to access the virtual memory address are directed to the physical memory address in the overflow memory.

Description

TECHNICAL FIELD

[0001] The present invention relates generally to buffer overflow capture, and more specifically, to a non-backed memory honey pot for buffer overflow capture. BACKGROUND

[0002] Memory management is the process of controlling and coordinating computer memory, including allocating portions of memory to various programs that are executing. Memory management functions can reside in computer hardware, operating systems (OS), as well as programs and applications. A buffer overflow refers to a situation in which a program executing on a computer begins accessing (reading or writing) a portion of memory that is not allocated to the program. The portion of memory that is not allocated to the program can be allocated to another program that is executing on the computer. Buffer overflows can arise from human error, such as a programming error. In other cases, buffer overflows can be performed purposefully and result in the execution of malicious code. SUMMARY

[0003] Embodiments of the invention relate to buffer overflow capture. A non-limiting example computer-implemented method includes receiving, at an operating system executing on a processor, a write request from a program to write data to memory. The write request includes a virtual memory address and data. The method determines that the virtual memory address is not allocated to a physical memory address. Based on the determination, the virtual memory address is allocated to a physical memory address in an overflow memory. The data is written to the physical memory address in the overflow memory, and an indication of a successful write of the data is returned to the program. Future requests by the program to access the virtual memory address are directed to the physical memory address in the overflow memory.

[0004] Other embodiments of the invention implement features of the above-described methods in computer systems and computer program products.

[0005] Additional technical features and benefits are realized through the techniques of the present invention. Embodiments and aspects of the invention are described in detail herein and are considered a part of the claimed subject matter. For a better understanding, refer to the detailed description and to the drawings. BRIEF DESCRIPTION OF DRAWINGS

[0006] The specifics of the exclusive rights described herein are particularly pointed out and distinctly claimed in the claims that follow. The foregoing and other features and advantages of the embodiments of the present invention will become more apparent from the following detailed description, taken in conjunction with the accompanying drawings, in which:

[0007] Figure 1 depicts a block diagram of a system for buffer overflow capture in accordance with one or more embodiments of the present invention;

[0008] Figure 2 a block diagram depicting components of buffer overflow capture in accordance with one or more embodiments of the application;

[0009] Figure 3 a flow diagram depicting a process for buffer overflow capture in accordance with one or more embodiments of the application;

[0010] Figure 4 a cloud computing environment in accordance with one or more embodiments of the application;

[0011] Figure 5 an abstraction model layer in accordance with one or more embodiments of the application; and

[0012] Figure 6 a system for buffer overflow capture in accordance with one or more embodiments of the application.

[0013] The figures depicted herein are illustrative. Numerous variations are possible, which would be apparent to one skilled in the art, without departing from the spirit of the application. For example, the acts recited in the figures or operations can be performed in a different order than that described, or additional, fewer, or different acts can be performed. Further, the term "coupled" and variations thereof describes having a communication path between two elements and does not imply a direct connection between the elements without an intermediate element / connection. All such variations are considered to be part of the specification. DETAILED DESCRIPTION

[0014] One or more embodiments of the application provide a defense mechanism against buffer overflows by artificially inserting holes in the normal contiguous memory allocation. According to one or more embodiments of the application, a translation table is used to map virtual memory addresses to physical addresses, and a strategic hole is placed in the mapping of the translation table to force a buffer overflow into an area with a higher probability of being open. An open area in the translation table contains a virtual address that has not been allocated to a physical memory address, and thus is not backed by physical memory. According to one or more embodiments of the application, a program that crosses its memory boundary by requesting access to an unsupported virtual memory address via the translation table triggers the computer system's memory manager to take the requested virtual address and place the data into a memory area referred to herein as overflow or honeypot memory.

[0015] Overflow or honeypot memory can be implemented by a pool of well-known and controlled memory regions within a computer system. According to one or more embodiments of the present invention, overflow memory regions are configured to prevent their contents from being executable by a program. This can be accomplished, for example, by setting an Instruction Execution Protection (IEP) bit to prevent code in the respective storage blocks of the overflow memory from being executed. At the same time as writing to the overflow memory, an intensive logging process can simultaneously collect information about the programs and / or data being written. The collected information can be stored and then analyzed.

[0016] As known to those skilled in the art, the term "honeypot" refers to a computer security mechanism that is set up to detect, deflect, or in some way resist attempts at unauthorized use of an information system. Typically, a honeypot includes data that appears to be a legitimate part of a site or application but is actually isolated and monitored. The honeypot appears to contain information or resources of value to an attacker who is then thwarted. The terms honeypot memory and overflow memory are used interchangeably herein to refer to a portion of memory that is utilized by one or more embodiments of the present invention when a program attempts to access a memory location that is not allocated to the program.

[0017] When computer programs utilize different regions of the same physical memory, it is important to keep the computer programs running within their allocated memory regions. Higher level (e.g., source code level) software programs have checks that generally keep all of the program's execution and data in organized locations within their allocated memory regions. However, at the microcode (or assembly) level, these built-in checks are generally not available. This can occur for a variety of reasons, but the most predominant of these are efficiency and / or performance considerations. The system trusts the information given to the microcode or assembly instructions to be valid, so these operations generally do not check data integrity. This allows these operations to execute as quickly as possible.

[0018] In many of these lower level operations, the system utilizes a memory manager to proxy requests between the virtual memory of a given program and the physical or real memory in which the data is stored. As noted above, in contemporary systems, the memory manager typically performs memory access requests without checking for repercussions, trusting that checks performed by the software layers above it ensure correct execution. Because the memory manager does not check for buffer overflows, a given program can access regions of virtual or physical memory that it should not be able to access. Buffer overflows can be caused by human error, or can be done intentionally for malicious reasons. Often, buffer overflows are due to miscalculated addresses or memory offsets, resulting in requests to memory locations outside of the memory region of the requesting program, which is defined by any arbitration functionality (e.g., a hypervisor) under which the program is running. When a buffer overflow occurs, the given program can overwrite or manipulate data used by another running program, which can cause a number of errors, crashes, conflicts, etc., which can result in system downtime.

[0019] One or more embodiments of the present invention provide technical improvements to current methods of providing access to memory that can result in buffer overflows. A drawback of contemporary methods is that a program can gain access to a memory region allocated to another program, and thus cause errors when executing the other program, for example, by overwriting memory locations used by the other program. This can be caused by, for example, poor code structure or by poor handling of data sizes that result in being able to write to memory portions just outside of the boundaries of a code base. In addition, accessing a memory region allocated to another program can cause errors in the program accessing the memory, for example, by causing the program to read and act on data from the other program that is assumed to be invalid. Another drawback of contemporary methods is that when a program requests access to a virtual memory address that is not supported by physical memory, the program is notified of the error. In the case of a malicious attack, the attacker is notified of the virtual address that is invalid, and the attacker can attempt to access other virtual addresses until locating an address that is supported by memory.

[0020] One or more embodiments of the present invention provide a technical solution to one or more of these shortcomings by creating a translation table with strategically placed gaps where a virtual address does not map to a physical address (i.e., unsupported virtual memory addresses). When a program attempts to access one of the unsupported memory addresses, the memory manager directs the access to overflow memory (e.g., by associating the virtual memory address in the request with a physical address in the overflow memory) and allows the program to perform the access in the overflow memory. The redirection to the overflow area is transparent to the requesting program, such that a potential hacker or threat actor does not know that the program is accessing memory locations in the overflow area. The redirection of the memory access prevents the program from accessing data outside of the memory area it is allocated, which can result in a reduction of system errors. Additionally, in response to detecting access to the overflow memory, one or more embodiments of the present invention collect state information about the program and / or data being written that can be used to identify and analyze the program. In the case where the program is a malicious program, this information can be used to provide awareness of the offending program and / or prevent one or more programs employing similar tactics from being executed in the future.

[0021] Turning now to Figure 1 , a block diagram of a system 100 for buffer overflow capture is shown, in accordance with one or more embodiments of the present invention. The system includes an operating system (OS) 102, a hypervisor 108, memory 110, and overflow memory 114. As shown, Figure 1 the OS 102 includes a memory manager 106, programs 104 executed by the OS 102, and a system and memory analyzer 116. In the embodiment shown, Figure 1 the memory manager 106 provides an interface between the programs 104 and the hypervisor 108 to request access to the memory 110. In addition, the memory manager 106 provides an interface to redirect memory access requests from the programs 104 to the overflow memory 114, if needed, to avoid buffer overflows. Figure 1 the system and memory analyzer 116 collects state information about the programs requesting access to the unsupported memory addresses and / or about the data being written that can be used to identify and analyze the programs.

[0022] According to one or more embodiments of the present application, the memory manager 106 receives virtual memory addresses from the program 104 and converts them to physical memory addresses located in the program memory 112 or the overflow memory 114. The memory manager 106 can include a translation lookaside buffer (TLB) as is known in the art to perform this conversion. A simple check can be employed to identify when the program 104 attempts to access a memory location outside of its original allocated space. A valid virtual memory address has physical memory allocated to it, and if a program or process requests data to an unsupported memory location, the memory manager 106 immediately knows that the address is incorrect and will not perform the request. The ability of the memory manager 106 to detect these buffer overflows is used by one or more embodiments of the present application as a mechanism to identify possible malicious programs.

[0023] According to one or more embodiments of the present application, the overflow memory 114 is located in a different physical storage device (or storage module or storage system) than the memory 110 that includes the program memory 112. According to one or more other embodiments of the present application, the overflow memory 114 and the memory 110 are located in different areas of the same memory device (or memory module or memory system).

[0024] According to one or more embodiments of the present application, program 104 sends a write request to memory manager 106 including a virtual memory address and data. Memory manager 106 forwards the request to hypervisor 108, which instructs memory 110 to write the data to a memory location in memory 110 at a physical memory address associated with the virtual memory address. If the virtual memory address is an unsupported virtual memory address, memory 110 returns an error to hypervisor 108 indicating an unsupported state, which hypervisor relays to OS 102. Hypervisor 108 can then allocate or assign an area in honeypot or overflow memory 114 for buffer overflows by program 104, and notify memory manager 106 of the allocation. Memory manager 106 can store a correspondence between the virtual memory address in the write request from program 104 and a physical memory address in overflow memory 114 in a TLB or another location. Hypervisor 108 writes the data to a location in overflow memory 114. Overflow memory 114 indicates to hypervisor 108 that the write was successful, and hypervisor 108 communicates the successful write status to program 104, and program 104 continues execution. The next time program requests access to the unsupported virtual memory address, memory manager 106 directs the access to overflow memory 114 allocated to program 104. The memory translation error is hidden from program 104. Memory manager 106 flags the request and hands back the address of the area in overflow memory 114, and forwards all subsequent requests in that range (e.g., at that virtual memory address) there. Memory manager 106 can additionally flag requests for additional pages requested by program 104, and send them to the area in overflow memory 114. According to one or more embodiments of the present application, overflow memory 114 is large enough, and if it nears being completely filled, writes the contents of overflow memory 114 out to a disk configured such that all information can be captured.

[0025] It should be appreciated that Figure 1 the block diagram of system 100 is not intended to indicate that system 100 will include Figure 1 all of the components shown in FIG. 1, but that system 100 can include Figure 1any appropriate fewer or additional components (e.g., additional memory components, programs, connections between function blocks, modules, inputs, outputs, etc.) not shown. For example, the system and memory analyzer 116 can be included in the memory manager 106. In another example, the system and memory analyzer 116 can be executed on a different processor under a different OS 102 than the memory manager 106. Further, embodiments described herein with respect to the device 100 can be implemented with any appropriate logic, where logic as referred to herein can include any appropriate hardware (e.g., a processor, an embedded controller, or an application specific integrated circuit, etc.), software (e.g., an application, etc.), firmware, or any appropriate combination of hardware, software, and firmware in various embodiments.

[0026] Turning now to Figure 2 , a block diagram 200 of components for buffer overflow capture is generally shown, in accordance with one or more embodiments of the present application. Figure 2 The block diagram 200 of FIG. 2 shows a high-level flow of interactions between a TLB 208, the system and memory analyzer 116, the memory manager 106, the overflow memory 114, and a human 206 (e.g., a system analyst or a security analyst).

[0027] Figure 2 The block diagram 200 of FIG. 2 includes the TLB 208 for translating virtual memory addresses to physical memory addresses. Figure 2 The TLB 208 shown includes memory-backed virtual memory addresses 204a, 204b, 204c, collectively referred to herein as memory-backed virtual memory addresses 204, which correspond to physical memory addresses. The TLB 208 also includes un-backed virtual memory addresses 202a, 202b, 202c, 202d, collectively referred to herein as un-backed virtual memory addresses 202, which are not assigned to physical memory addresses. The placement of un-backed virtual memory addresses 202 among the memory-backed virtual memory addresses 204 is an example of artificially putting holes into a normally contiguous memory allocation (e.g., sparse memory placement).

[0028] Figure 2 The TLB 208 shown includes strategically placed holes in the TLB’s mapping in order to force a violation buffer overflow into an area with a higher probability of being open. This arrangement of placing holes in the TLB mapping is referred to herein as configuring the TLB using “sparse memory placement.” In accordance with one or more embodiments of the present application, the memory-backed virtual memory addresses 204a include all virtual memory addresses assigned to “program a,” the memory-backed virtual memory addresses 204b include all virtual memory addresses assigned to “program b,” and the memory-backed virtual addresses 204c include all virtual memory addresses assigned to “program c.” As shown, the un-backed virtual memory addresses 202a, 202b, 202c, 202d are placed among the memory-backed virtual memory addresses 204a, 204b, 204c.Figure 2 As shown in TLB 208, memory allocation has been strategically done to allow for large space regions between virtual addresses allocated to programs, making it more difficult for one program to overlap with the memory of another program.

[0029] Implementations of TLB 208 are not limited to keeping all virtual addresses of a program in contiguous entries, as the memory allocated to a program can be broken down into multiple segments. One or more embodiments of the invention may offset common memory segments (e.g., 512 megabytes (MB) or 2048 MB pages) and place unsupported memory segments at the beginning and end of each segment with known offsets. For example, if the page ends at memory address 0x000A, a hole can be placed in TLB 208 for location 0x000B. If a program or process attempts to access this memory segment, it will fail immediately. Without this scheme, if location 0x000B is being used (and therefore supported) by another program or process, the faulty process might keep rewriting 0x000B to the next unbacked-up memory location, which could be an entire page, thus corrupting and affecting the operation of many other processes.

[0030] Utilize Figure 2 The TLB 208, as shown, is a memory system with numerous holes in its memory space, allowing for a certain inherent defense against malicious buffer overflows by making it less likely for buffer overflows to spill into the memory of another program. Additionally, one or more embodiments of the invention utilize the ability of a virtual memory system (e.g., memory manager 106) to know whether a page is supported in order to detect if a program has crossed its boundaries. Once a trigger indicating that a program has crossed its boundaries occurs, memory manager 106 places the data being written into a honeypot or overflow memory 114. A honeypot may seem like something a malicious actor would want, but it is actually a trap that provides a better understanding of the attacker.

[0031] According to one or more embodiments of the present invention, the honeypot or overflow memory 114 is located in a publicly known and controlled pool of memory regions within the system. Each memory portion in the memory pool may have an instruction execution protection (IEP) bit setting to prevent the execution of any code or computer instructions stored in that portion. Since the system cannot execute what is written to that location, it is safe to allow writing to that location and inspect the contents of the data. When the memory manager 106 detects a buffer overflow, it enters the memory region pool and begins allowing programs to write to that memory (e.g., overflow memory 114), while simultaneously initiating an intensive recording process using the system and memory analyzer 116 to collect information about the program or data being written. Figure 2As shown, a code buffer overflow is detected in an unsupported memory unit 202c, and the overflow detection triggers the memory manager 106, which directs the data to a memory sub-pool containing overflow memory 114.

[0032] According to one or more embodiments of the present application, the system and memory analyzer 116 records state information about the program and / or data, such as but not limited to: an identifier of the program or process that caused the buffer overflow; the data being written; network activity; code style; a message digest algorithm 5 (MD5) hash of the data being written (e.g., computer code); addresses accessed by the computer code being written; a loader associated with the execution of the computer code being written; and / or other statistics about the memory contents, such as the size and address of the code requesting access. The collected data can be saved (e.g., written to memory) and then analyzed. The analysis can be performed manually by a person 206, such as a system administrator or security analyst, and / or the analysis can be automatic.

[0033] According to one or more embodiments of the present application, the information (e.g., state information) collected by the system and memory analyzer 116 can be checked against publicly known attack frameworks, such as but not limited to Mitre Att&ck™, to determine whether the behaviors and / or threat tools associated with the MD5 hashes, statistics, addresses, etc. are associated with known threat actors or patterns. A threat actor, as known in the art, refers to any entity that attempts or succeeds in carrying out malicious activity against an enterprise, whether intentional or unintentional. This information about whether the buffer overflow is associated with a publicly known threat actor or pattern can be further used by a person 206, such as a system administrator or security analyst, to protect the machine and find additional attack surfaces to further protect the enterprise. For example, the security policy of the processor can be updated based on the state information. Examples of security policies include, but are not limited to: network signatures, log record tracking, programs allowed to execute on the machine, data access, and identities used.

[0034] According to one or more embodiments of the present application, given the intensive recording of all memory forwarding and information, the system and memory analyzer 116 can be placed inside a separate hardware to speed up the response to such attacks. In addition, all or a portion of the memory manager 106 can also be located on a separate hardware.

[0035] Turning now to Figure 3 , a flowchart of a process 300 for buffer overflow capture is generally shown, according to one or more embodiments of the present application. Figure 3 The processes shown can be performed by an operating system executing on a computer processor, such as Figure 1OS 102. The computer processor can be a standalone processor or a node in the cloud, such as Figure 4 node 10 in the cloud.

[0036] At block 302, a write request is received from a program. The write request includes a virtual memory address and data to be written to memory. At block 304, it is determined that the virtual memory address is not assigned to a physical memory address, and that the virtual memory address is assigned to a physical memory address in an overflow memory. At block 306, the data is written to the physical memory address in the overflow memory. At block 308, an indication is returned to the program that the data write request was successfully completed. According to one or more embodiments of the application, the program is unaware that the data was written to an overflow location. An indicator that the data was successfully written to memory is returned to the program, and future requests by the program to access the virtual memory address are directed to the physical memory address in the overflow memory.

[0037] According to one or more embodiments of the application, responsive to determining that the virtual address is not assigned to a physical memory address, recording of state information about one or both of the data and the program is initiated. The state information can be used to identify patterns associated with a malicious program or a threat actor. According to one or more embodiments of the application, a security policy of the processor is updated based at least in part on the state information.

[0038] According to one or more embodiments of the application, the overflow location is configured to prevent computer code from executing from the overflow location. According to one or more embodiments of the application, a TLB is used to translate the virtual memory address to the physical memory address, and the TLB is configured using sparse memory placement.

[0039] One or more embodiments of the application are implemented based on a buffer overflow mode of the processor. For example, the buffer overflow mode of the processor can be determined based on a setting of a flag or other indicator, and the writing of data to the overflow memory location can be performed based on the buffer overflow mode of the processor being a first mode. Based on the buffer overflow mode being a second mode, blocks 304 and 306 can be skipped, and instead an indication is returned to the program that the write was not successfully completed. Additionally or alternatively, the buffer overflow mode can be associated with a particular program or group of programs. The buffer overflow mode of the processor is programmable, and can be set automatically or by a person such as a system administrator. In this way, the writing to and analysis of the overflow memory location responsive to detecting a buffer overflow condition can be selectively applied during a particular lifecycle phase (e.g., during testing), for programs running on a particular processor, for a particular program, for programs executing during a selected timeframe, etc.

[0040] Figure 3The process flow diagram of FIG. 1 is not intended to indicate that the operations of the method 100 are to be executed in any particular order, or that all of the operations of the method 100 are to be included in every instance of the method 100. Additionally, the method 100 can include any suitable number of additional operations.

[0041] It should be appreciated that while the present disclosure includes detailed descriptions of cloud computing, implementation of the teachings presented herein are not limited to cloud computing environments. Rather, embodiments of the application are capable of implementation in conjunction with any other type of computing environment now known or later developed.

[0042] Cloud computing is a model of service delivery for enabling convenient, on-demand network access to a shared pool of configurable computing resources (e.g. networks, network bandwidth, servers, processing, memory, storage, applications, virtual machines, and services) that can be rapidly provisioned and released with minimal management effort or interaction with a provider of the service. This cloud model can include at least five characteristics, at least three service models, and at least four deployment models.

[0043] Features include the following:

[0044] On-demand self-service: cloud consumers can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with the service's provider.

[0045] Broad network access: capabilities are available over a network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

[0046] Resource pooling: the provider's computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to demand. There is a sense of location independence in that the consumer generally has no control or knowledge over the exact location of the provided resources but can be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter).

[0047] Rapid elasticity: capabilities can be rapidly and elastically provisioned, in some cases automatically, to quickly scale out and rapidly scale in. To the consumer, the provider's ability to provision capabilities on-demand and in near real-time allows for rapidly adjusting to demand.

[0048] Measured service: cloud systems automatically control and optimize resource use by leveraging utilization of resources that are dynamically assigned and reassigned, as needed. Resources usage can be monitored, controlled, and reported, providing transparency for both the provider and the consumer of the utilized service.

[0049] Service models include the following:

[0050] Software as a Service (SaaS): the capability provided to the consumer is to use the provider's applications running on a cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based e-mail). The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application configuration settings.

[0051] Platform as a Service (PaaS): the capability provided to the consumer is to deploy onto the cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying cloud infrastructure including networks, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations.

[0052] Infrastructure as a Service (laaS): the capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying cloud infrastructure but has control over operating systems, storage, deployed applications, and possibly limited control of select networking components (e.g., host firewalls).

[0053] Deployment models are as follows:

[0054] Private cloud: the cloud infrastructure is operated solely for an organization. It can be managed by the organization or a third party and can exist on-premises or off-premises.

[0055] Community cloud: the cloud infrastructure is shared by several organizations and supports mission-oriented business

[0056] Public cloud: the cloud infrastructure is made available to general public or a large industry group and is owned by an organization selling cloud services.

[0057] Hybrid cloud: the cloud infrastructure is a composition of two or more clouds (private, community, or public) that remain unique entities but are bound together, creating the hybrid cloud.

[0058] A cloud computing environment is service-oriented, focusing on statelessness, loose coupling, modularity, and semantic interoperability. At the core of cloud computing is an infrastructure comprising a network of interconnected nodes.

[0059] Referring now to Figure 4 , an illustrative cloud computing environment 50 is depicted. As shown, cloud computing environment 50 includes one or more cloud computing nodes 10 with which Figure 4 The types of computing devices 54A-N shown in

[0060] Referring now to Figure 5 , a set of functional abstraction layers provided by cloud computing environment 50 Figure 4 It should be previously understood that Figure 5 The components, layers, and functions shown in

[0061] Hardware and software layer 60 includes hardware and software components. Examples of hardware components include: mainframes 61; RISC (Reduced Instruction Set Computer) architecture based servers 62; servers 63; blade servers 64; storage devices 65; and networks and networking components 66. In some embodiments, software components include network application server software 67 and database software 68.

[0062] Virtualization layer 70 provides an abstraction layer from which the following examples of virtual entities can be provided: virtual servers 71; virtual storage 72; virtual

[0063] In one example, management layer 80 can provide the functions described below. Resource provisioning 81 provides dynamic procurement of computing resources and other resources that are utilized to perform tasks within the cloud computing environment. Metering and Pricing 82 provide cost tracking as resources are utilized within the cloud computing environment, and billing or invoicing for consumption of these resources. In one example, these resources can include application software licenses. Security provides identity verification for cloud consumers and tasks, as well as protection for data and other resources. User portal 83 provides access to the cloud computing environment for consumers and system administrators. Service level management 84 provides cloud computing resource allocation and management such that required service levels are met. Service Level Agreement (SLA) planning and fulfillment 85 provide pre-arrangement for, and procurement of, cloud computing resources for which future requirements are anticipated in accordance with an SLA.

[0064] Workloads layer 90 provides examples of functionality for which the cloud computing environment can be utilized. Examples of workloads and functions which can be provided from this layer include: mapping and navigation 91; software development and lifecycle management 92; virtual classroom education delivery 93; data analysis processing 94; transaction processing 95; and batch processing 96.

[0065] It is understood that one or more embodiments of the present application can be implemented in conjunction with any type of computing environment now known or later developed.

[0066] Turning now to Figure 6 , a computer system for buffer overflow capture is generally shown in accordance with one or more embodiments of the present application. The methods described herein can be implemented in hardware, software (e.g., firmware), or combinations thereof. In one or more example embodiments of the application, the methods described herein are implemented in hardware as part of a microprocessor of a special or general purpose digital computer, such as a personal computer, workstation, minicomputer, or mainframe computer. Thus, system 600 can comprise a general or mainframe computer 601 capable of concurrently running multiple instances of an O / S.

[0067] In one or more example embodiments of the application, in terms of hardware architecture, as shown in FIG. 6, computer system 600 can include a processor 602, memory 604, storage 606, an input / output (I / O) interface 608, and a bus 610. Figure 6As shown, computer 601 includes one or more processors 605, memory 610 coupled to memory controller 615, and one or more input and / or output (I / O) devices 640, 645 (or peripherals) coupled by input / output controller(s) 635. The input / output controller(s) 635 can be, for example, but is not limited to, one or more buses or other wired or wireless connections, as is known in the art. The input / output controller(s) 635 can have additional elements, which are omitted for simplicity, such as controllers, buffers (caches), drivers, repeaters, and receivers, to enable communications. Further, the local interface can include address, control, and / or data connections to enable appropriate communications among the aforementioned components.

[0068] Processor 605 is a hardware device for executing software, particularly that stored in memory 610 or on storage device 620. The processor 605 can be any custom made or commercially available processor, a central processing unit (CPU), an auxiliary processor among several processors associated with the computer 601, a semiconductor based microprocessor (in the form of a microchip or chip set), a macroprocessor, or generally a device that processes instructions.

[0069] Memory 610 can include any one or a combination of volatile memory elements (e.g., random access memory (RAM, such as DRAM, SRAM, SDRAM, and / or the like)) and nonvolatile memory elements (e.g., ROM, erasable programmable read only memory (EPROM), electrically erasable programmable read only memory (EEPROM), programmable read only memory (PROM), tape, compact disc read only memory (CD-ROM), disk, diskette, and / or the like). Additionally, memory 610 can include elements of a computer- readable medium, and can take many forms, including but not limited to tangible storage media, caches, and / or the like. Storage media can be embodied in a computer program product, which can be distributed over

[0070] The instructions in memory 610 can include one or more separate programs, each of which comprises an ordered listing of executable instructions for implementing logical functions. In Figure 6 In an example, the instructions in memory 610 are a suitable operating system (OS) 611. Operating system 611 essentially controls the execution of other computer programs, and provides scheduling, input-output control, file and data management, memory management, and communication control and related services.

[0071] According to one or more embodiments of the present application, memory 610 can include a plurality of logical partitions (LPARs), each of which runs an instance of an operating system. The LPARs can be managed by a hypervisor, which can be a program stored in memory 610 and executed by processor 605.

[0072] In one or more example embodiments of the application, a conventional keyboard 650 and mouse 655 can be coupled to input / output controller 635. Other output devices such as I / O devices 640, 645 can include input devices such as, but not limited to, a printer, a scanner, a microphone, etc. Finally, I / O devices 640, 645 can also include devices that communicate both ways, such as, but not limited to, a network interface card (NIC) or modulator / demodulator (modem) for accessing other files, devices, systems or a network, a radio frequency (RF) or other transceiver, a telephonic interface, a bridge, a router etc. System 600 can also include a display controller 625 coupled to a display 630.

[0073] In one or more example embodiments of the application, system 600 can also include a network interface 660 for coupling to a network 665. Network 665 can be an IP-based network for communication between computer 601 and any external server, client and the like via a broadband connection. Network 665 transmits and receives data between computer 601 and external systems. In an example embodiment, network 665 can be a managed IP network administered by a service provider. Network 665 can be implemented using a mix of wired and wireless transmissions. Network 665 can be wired using, for example, Time Division Multiplexing (TDM) technology, Asynchronous Transfer Mode (ATM) technology, Data Over Cable Service Interface Specification (DOCSIS) technology, Frame Relay technology, or the like. Network 665 can be wireless, using, for example, IEEE 802.11 technology, Bluetooth technology, or the like. Network 665 can be a packet-switched network, a circuit-switched network, or a combination of a packet-switched and a circuit-switched network. Network 665 can be a local area network, a wide area network, a metropolitan area network, the Internet, or the like. Network 665 can be a fixed wireless network, a wireless local area network (LAN), a wireless wide area network (WAN), a personal area network (PAN), a virtual private network (VPN), an intranet, or the like, and includes equipment for receiving and transmitting signals.

[0074] If computer 601 is a PC, workstation, intelligent device or the like, the instructions in memory 610 can further include a basic input output system (BIOS) (omitted for simplicity). The BIOS is a set of basic software routines that initialize and test hardware, start the OS 611, and support data transfer between hardware devices. The BIOS is stored in ROM so that the BIOS can be executed when computer 601 is activated.

[0075] When the computer 601 is in operation, the processor 605 is configured to execute instructions stored in the memory 610, to communicate data to and from the memory 610, and to generally control operations of the computer 601 pursuant to the instructions. Figure 4 and the cloud computing node 10 of

[0076] Various embodiments of the application are described herein with reference to the related drawings. Alternative embodiments of the application can be devised without departing from the scope of the application. In the following description, various connections and positional relationships (e.g., above, below, adjacent, etc.) are set forth in connection with the illustrative embodiments. Unless otherwise noted, these connections and / or positional relationships can be direct or indirect, and the present application is not intended to be limiting in this respect. Accordingly, a coupling of entities can refer to either a direct or an indirect coupling, and a positional relationship between entities can be a direct or indirect positional relationship. Moreover, the various tasks and process steps described herein can be carried out in a variety of ways, including but not limited to, by a dedicated hardware circuit, by a programmed processor, or by any combination of these approaches.

[0077] The one or more methods described herein can be implemented in any of the following technologies, or combinations thereof, which are all well known in the art: a discrete logic circuit(s) having logic gates for implementing logic functions upon an application of data signals; an application specific integrated circuit (ASIC), a programmable gate array(s) (PGA), a field programmable gate array (FPGA), etc.

[0078] For the sake of brevity, conventional techniques related to making and using aspects of the application can or can not be described in detail herein. In particular, various aspects of computing systems and specific computer programs to implement the various technical features described herein are well known. Accordingly, in the interest of brevity, many conventional implementation details are only mentioned briefly herein or are omitted entirely without providing the well-known system and / or process details.

[0079] In some embodiments, various functions or acts can be performed in a given position and / or in connection with one or more apparatuses or systems. In some embodiments, a portion of a given function or act can be performed in a first device or position and another portion of the same function or act can be performed in one or more additional devices or positions.

[0080] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting. As used herein, the singular forms "a," "an," and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0081] All means or step plus function elements in the claims that follow the expression "means for" or "step for" are intended to cover any structure for performing the stated function and also cover equivalent structures. The disclosure is presented to enable anyone skilled in the art to practice the application as claimed below and

[0082] The diagrams depicted herein are illustrative. There can be many variations to the diagrams or the steps (or operations) described therein without departing from the spirit of the disclosure. For instance, the actions can be performed in a differing order or actions can be added, deleted, modified, or modified to name a few. Additionally, the term "coupled” describes having a signal path between two elements and does not imply a direct connection between the elements with no intermediate elements / connections therebetween. All these variations are considered a part of the disclosure.

[0083] The following definitions and abbreviations are used throughout the specification and claims. As used herein, the terms "comprises," "comprising," "includes," "including," "has," "having," or any other variation thereof, are intended to cover a non-exclusive inclusion. For example, a composition, a mixture, a process, a method, an article, or an apparatus that comprises a list of elements is not necessarily limited to only those elements but can include other elements not expressly listed or inherent to such composition, mixture, process, method, article, or apparatus.

[0084] In addition, the term "exemplary" is used herein to mean "serving as an example, instance, or illustration." Any implementation or design described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other implementations or designs. The terms "at least one" and "one or more" are understood to include any integer number greater than or equal to one, i.e., one, two, three, four, etc. The terms "a plurality" are understood to include any integer number greater than or equal to two, i.e., two, three, four, five, etc. The term "connected" can include both "indirectly connected" and "directly connected."

[0085] The terms“about,”“substantially,”“approximately,” and variations thereof, are intended to encompass a degree of error acceptable by the particular quantification based on the equipment available at the time of submission. For example,“about” can include a range of ± 8% or 5%, or 2% of a given value.

[0086] The present application can be a system, a method, and / or a computer program product at any possible technical detail level of integration. The computer program product can include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present application.

[0087] The computer readable storage medium can be a tangible device that can retain and store instructions for use by an instruction execution device. The computer readable storage medium can be, for example, but is not limited to, an electronic storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, or any suitable combination of the foregoing. A non-exhaustive list of more specific examples of the computer readable storage medium includes the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanically encoded device such as punch-cards or raised structures in a groove having instructions recorded thereon, and any suitable combination of the foregoing. A computer readable storage medium, as used herein, is not to be construed as being transitory signals per se, such as radio waves or other freely propagating electromagnetic waves, electromagnetic waves propagating through a waveguide or other transmission media (e.g., light pulses passing through a fiber-optic cable), or electrical signals transmitted through a wire.

[0088] Computer readable program instructions described herein can be downloaded to respective computing / processing devices from a computer readable storage medium or to an external computer or external storage device via a network, for example, the Internet, a local area network, a wide area network and / or a wireless network. The network can comprise copper transmission cables, optical transmission fibers, wireless transmission, routers, firewalls, switches, gateway computers and / or edge servers. A network adapter card or network interface in each computing / processing device receives computer readable program instructions from the network and forwards the computer readable program instructions to a computer readable storage medium within the respective computing / processing device for storage and / or execution.

[0089] Computer readable program instructions for carrying out operations of the present application can be assembly instructions, instruction-set-architecture (ISA) instructions, machine instructions, microcode, firmware instructions, state-setting data, configuration data for an integrated circuit, or source code or object code written in any combination of one or more programming languages, including an object-oriented programming language such as Smalltalk, C++ or the like, and a procedural programming language such as the "C" programming language or similar programming languages. The computer readable program instructions can execute entirely on the user's computer, partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection can be made to an external computer (for example, through the Internet using an Internet Service Provider). In some embodiments, electronic circuitry including, for example, programmable logic circuitry, field-programmable gate arrays (FPGA), or programmable logic arrays (PLA) can execute the computer readable program instructions by utilizing state information of the computer readable program instructions to personalize the electronic circuitry, in order to perform aspects of the present application.

[0090] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0091] These computer readable program instructions can be provided to a processor of a general purpose computer, special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions / acts specified in the flowchart and / or block diagram block or blocks. These computer readable program instructions can also be stored in a computer readable storage medium that can direct a computer, a programmable data processing apparatus, and / or other devices to function in a particular manner, such that the computer readable storage medium having instructions stored therein comprises an article of manufacture including

[0092] The computer readable program instructions can also be loaded onto a computer, other programmable data processing apparatus, or other device to cause a series of operational steps to be performed on the computer, other programmable apparatus or other device to produce a computer implemented process such that the instructions which execute on the computer, other programmable apparatus, or other device implement the functions / acts specified in the flowchart and / or block diagram block or blocks.

[0093] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of instructions comprising one or more executable instructions for implementing a specified logical function. In some alternative embodiments, the functions indicated in the blocks may occur in a non-consecutive order as shown in the figures. For example, two blocks shown consecutively may actually be executed substantially simultaneously, or these blocks may sometimes be executed in reverse order, depending on the functions involved. It will also be noted that each block in the block diagrams and / or flowcharts, and combinations of blocks in the block diagrams and / or flowcharts, may be implemented by a dedicated hardware-based system that performs the specified function or action or executes a combination of dedicated hardware and computer instructions.

[0094] Various embodiments of the invention have been described for illustrative purposes, but are not intended to be exhaustive or limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein has been chosen to best explain the principles of the embodiments, their practical application, or improvements to existing technologies on the market, or to enable others skilled in the art to understand the embodiments described herein.

Claims

1. A method for buffer overflow capture, comprising: At the operating system running on the processor, a write request is received from the program to write data to memory, the write request including a virtual memory address and the data; It was determined that the virtual memory address was not assigned to a physical memory address; Based on the determination, the virtual memory address is assigned to the physical memory address in the overflow memory; In response to determining that the virtual memory address has not been assigned to a physical memory address, recording of status information about one or both of the data and the program is initiated. Write the data to the physical memory address in the overflow memory; as well as The program is returned an indication that the data has been successfully written to the memory, wherein subsequent requests by the program to access the virtual memory address are directed to the physical memory address in the overflow memory.

2. The method according to claim 1, wherein, The status information is used to identify patterns associated with malicious programs or threat actors.

3. The method according to claim 1, wherein, The processor's security policy is updated based at least in part on the state information.

4. The method according to claim 1, wherein, The data includes computer code, and the overflow location is configured to prevent the computer code from being executed from the overflow location.

5. The method according to claim 1, wherein, The virtual memory address is translated into a physical memory address using a Translation Lookaside Buffer (TLB), and the TLB is configured using sparse memory placement.

6. The method according to claim 1, further comprising: Determine the buffer overflow mode of the processor, wherein the allocation, write, and return are performed based on the processor's buffer overflow mode being a first mode; and Based on the fact that the buffer overflow mode is the second mode, in response to determining that the virtual memory address has not been assigned to a physical memory address in the memory, an indication that the write was not successfully completed is returned to the program.

7. A system for buffer overflow capture, comprising: One or more processors for executing computer-readable instructions, the computer-readable instructions controlling the one or more processors to perform operations, the operations including: At the operating system executing on one or more of the processors, a write request is received from a program to write data to memory, the write request including a virtual memory address and the data; It was determined that the virtual memory address was not assigned to a physical memory address; Based on the determination, the virtual memory address is assigned to the physical memory address in the overflow memory; In response to determining that the virtual memory address has not been assigned to a physical memory address, recording of status information about one or both of the data and the program is initiated; the data is written to the physical memory address in the overflow memory; and The program is returned an indication that the data has been successfully written to the memory, wherein subsequent requests by the program to access the virtual memory address are directed to the physical memory address in the overflow memory.

8. The system according to claim 7, wherein, The status information is used to identify patterns associated with malicious programs or threat actors.

9. The system according to claim 7, wherein, The processor's security policy is updated based at least in part on the state information.

10. The system according to claim 7, wherein, The data includes computer code, and the overflow location is configured to prevent the computer code from being executed from the overflow location.

11. The system according to claim 7, wherein, The virtual memory address is translated into a physical memory address using a Translation Lookaside Buffer (TLB), and the TLB is configured using sparse memory placement.

12. The system according to claim 7, wherein, The operation also includes: Determine the buffer overflow mode of the processor, wherein the allocation, write, and return are performed based on the processor's buffer overflow mode being a first mode; and Based on the fact that the buffer overflow mode is the second mode, in response to determining that the virtual memory address has not been assigned to a physical memory address in the memory, an indication that the write was not successfully completed is returned to the program.

13. A computer program product comprising a computer-readable storage medium, the computer-readable storage medium containing program instructions executable by a processor to cause the processor to perform operations, the operations including: At the operating system running on the processor, a write request is received from a program to write data to memory, the write request including a virtual memory address and the data; It was determined that the virtual memory address was not assigned to a physical memory address; Based on the determination, the virtual memory address is assigned to the physical memory address in the overflow memory; In response to determining that the virtual memory address has not been assigned to a physical memory address, recording of status information about one or both of the data and the program is initiated; the data is written to the physical memory address in the overflow memory; as well as The program is returned an indication that the data has been successfully written to the memory, wherein subsequent requests by the program to access the virtual memory address are directed to the physical memory address in the overflow memory.

14. The computer program product according to claim 13, wherein, The processor's security policy is updated based at least in part on the state information.

15. The computer program product according to claim 13, wherein, The data includes computer code, and the overflow location is configured to prevent the computer code from being executed from the overflow location.

16. The computer program product according to claim 13, wherein, The virtual memory address is translated into a physical memory address using a Translation Lookaside Buffer (TLB), and the TLB is configured using sparse memory placement.

17. The computer program product according to claim 13, wherein, The operation also includes: Determine the buffer overflow mode of the processor, wherein the allocation, write, and return are performed based on the processor's buffer overflow mode being a first mode; and Based on the fact that the buffer overflow mode is the second mode, in response to determining that the virtual memory address has not been assigned to a physical memory address in the memory, an indication that the write was not successfully completed is returned to the program.

Images