Reducing false positive indications of buffer overflow attacks

摘要: Certain events, such as data input operating system calls, are likely to initiate a buffer overflow attack. A timing module generates timestamps that indicate when possible initiating events occur. The timestamp is associated with particular process and/or thread executing on the computer. If subsequent evidence of attack detected computer, consulted determine if event occurred recently. there recent event, declared. Evidence can include receiving signal from processor indicating was asked execute an instruction residing in non-executable memory. also detecting action computer malicious software perform, opening file or network connection, being performed by