RESTRICTING MEMORY ALLOCATION AND RESOURCE USAGE OF LOW REPUTATION APPLICATIONS

Kartik Sura

Symantec Corporation

Abstract

The prioritized memory allocation and resource constraining tools of the latest operating systems, such as Windows 8, are used to limit the resources of low reputation software applications by forcing the use of low priority memory allocations and limiting the use of high priority memory.  Other restrictions are also implemented based on application reputation. 

Copyright © 2012 Symantec Corporation. All rights reserved. Symantec and the Symantec Logo are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners.  For a full list of Symantec trademarks, please visit

http://www.symantec.com/about/profile/policies/trademarks/currentlist.jsp

Any Symantec products described in this document are distributed under licenses restricting their use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any.

THE DOCUMENTATION IS PROVIDED “AS IS” AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE.

Symantec Corporation

350 Ellis Street

Mountain View, CA 94043

United States

http://www.symantec.com

RESTRICTING MEMORY ALLOCATION AND RESOURCE USAGE OF LOW REPUTATION APPLICATIONS

Problem Statement

Malicious applications often utilize the system resources to “starve” other legitimate applications of resources. Using conventional tools, the user has previously been able to only completely block and quarantine files having an insufficient or low reputation. There is no current means by which the user is able to allow some resources for a specific application and block or limit other resources for the same application. Further, there is no provision to handle "medium reputation" applications or "medium prevalence" software applications. 

Publication Description

Application programming interfaces (APIs) provide an interface for software components to communicate with each other.  In some Windows operating systems, a Win32 API hooking mechanism may be used to intercept API communications between various software components. The hooking mechanism is used herein to intercept APIs, such as those that spawn processes and allocate memory. Additionally, new “nested job objects”, such as is found in Windows 8, c...