US Patent 7870610 Detection of malicious programs

Various approaches for detecting unauthorized actions on a computing platform are disclosed. In one approach, a memory region is designated as tainted if data is received from an untrusted source (such as the network) and written to that region. Thereafter, destination regions may be designated as tainted based on an operation having source and destination parameters in which at least a portion of an address range of the source overlaps an address range of a tainted memory region, and data from the source is used to update the destination. If an argument in an invocation of a function call references a tainted memory region, the call is determined to be unauthorized and data is output indicative of the unauthorized call.