Buffer overflow exploit detection

摘要

A call to a memory management application programming interface (API) that results in a buffer overflow due to inaccurate bounds checking could potentially leave the system vulnerable to being exploited by a third party. Approaches presented herein can monitor calls to these APIs in order to determine typical memory sizes passed to these APIs. During an initial baselining period a number of profiles are generated that indicate expected memory size parameters under various different call conditions, such from specific sources or call stacks. Comparing subsequently received API calls against the expected values from the relevant profile enables the legitimacy of an API call to be determined with relatively high accuracy. A suspicious call is identified based at least in part upon determining that the memory size of the call falls outside an expected range for that API and the relevant context.