1. A method of detecting malware, the method comprising:
at a computer device having an operating system and a memory, executing an untrusted computer program in a sandbox environment; and
in the event that the untrusted program directly accesses a region of the memory used to store information relating to the operating system, determining that the trusted program is likely to be malware, the method further comprising:
marking regions of the memory used to store information relating to the operating system; and
monitoring direct access to the marked regions of the memory by the untrusted program, wherein a marked region of the memory includes any of:
a region that is automatically initialized by the operating system;
a region that is allocated by a call to a system library that returns a data structure that should not be accessed directly;
a region that is allocated by the untrusted program and passed as a parameter to a system function;
a region that includes local variables and passed as a parameter to a system function;
a region relating to code in shared libraries that are part of the operating system;
and a region relating to a volatile register value created from the return of an application programming interface call; the method further comprising: in the event that the memory region is marked owing to allocation by a call to a system library that returns a data structure that should not be accessed directly, removing the marking when a request is made to free the memory.
2. The method according to claim 1, further comprising subsequently removing the marking for a marked region of the memory.
3. The method according to claim 1, further comprising, in the event that the memory region is marked because it is allocated by the untrusted program and passed as a parameter to a system function is marked, removing the marking when a call to free the memory region is made.
4. The method according to claim 1, further comprising, in the event that a memory region is marked because it includes local variables and is passed as a parameter to a system function, removing the marking when any of a corresponding function to uninitialize a data structure in the memory region is called, the stack pointer moves such that a local variable is no longer in the stack, and the memory region is written to before it is read from.
5. The method according to claim 1, wherein direct access to marked regions of memory includes any of:
direct access to marked memory regions by the untrusted program; and
an execution transfer to marked memory regions, unless a target of the execution transfer has the same address of an exported function.
6. The method according to claim 1, further comprising, prior to determining that the untrusted program is likely to be malware, determining that the untrusted program is not provisioned in a whitelist of trusted programs.
7. A computer device comprising:
a computer readable medium in the form of a memory;
an operating system; and
a processor for executing an untrusted computer program in a sandbox environment;
wherein the processor is arranged to determine that the untrusted program is likely to be malware in the event that the untrusted program directly accesses a region of the memory used to store information relating to the operating system, wherein the processor is further arranged to mark regions of the memory used to store information relating to the operating system and monitor direct access to the marked regions of the memory by the untrusted program, and wherein the processor is arranged to mark a region of the memory selected from any of:
a region that is automatically initialized by the operating system;
a region that is allocated by a call to a system library that returns a data structure that should not be accessed directly;
a region that is allocated by the untrusted program and passed as a parameter to a system function;
a region that includes local variables and passed as a parameter to a system function;
a region relating to code in shared libraries that are part of the operating system; and
a region relating to a volatile register value created from the return of an application programming interface call;
wherein the processor is further arranged to, in the event that the memory region is marked owing to allocation by a call to a system library that returns a data structure that should not be accessed directly, remove the marking when a request is made to free the memory.
8. The computer device according to claim 7, wherein the processor is further arranged to subsequently remove the marking for a marked region of the memory.
9. The computer device according to claim 7, wherein the processor is arranged to, in the event that the memory region is marked because it is allocated by the 30 untrusted program and passed as a parameter to a system function is marked, remove the marking when a call to free the memory region is made.
10. The computer device according to claim 7, wherein the processor is arranged to, in the event that a memory region is marked because it includes local variables and is passed as a parameter to a system function, remove the marking when any of a corresponding function to uninitialize a data structure in the memory region is called, the stack pointer moves such that a local variable is no longer in the stack, and the memory region is written to before it is read from.
11. The computer device according to claim 7, wherein the processor is arranged to determine that direct access to marked regions of memory has occurred by determining the presence of any of:
direct access to marked memory regions by the untrusted program; and
an execution transfer to marked memory regions, unless a target of the execution transfer has the same address of an exported function.
12. The computer device according to claim 7, wherein the processor is arranged to, prior to determining that the untrusted program is likely to be malware, determine that the untrusted program is not provisioned in a whitelist of trusted programs.
13. The computer device according to claim 12, further comprising a whitelist of trusted programs.
14. A non-transitory computer readable medium including a computer program which, when run on a computer device, causes the computer device to perform the method according to claim 1.
15. The non-transitory computer readable medium including the computer program according to claim 14, wherein the computer program is stored on the non-transitory computer readable medium.
The claims below are in addition to those above.
All refrences to claim(s) which appear below refer to the numbering after this setence.
1. A remote weapon system, comprising:
a fire control unit; and
a mechanical support to which a weapon capable of firing airburst ammunition is mountable, the mechanical support being adapted to move the weapon in azimuth and elevation directions,
wherein the fire control unit comprises,
input means for receiving input parameters including at least one parameter related to a position of a detected target,
first calculation means for continuously calculating a dynamically variable geographical area to be covered by the airburst ammunition from said weapon based on a speed of the detected target and calculation of movement of the detected target starting from the position of the detected target, and
second calculation means for automatically calculating a number of shots to be fired by the weapon and azimuth and elevation directions of the mechanical support for each of the shots to be fired based on said input parameters such that substantially an entire final geographical area is covered by the airburst ammunition, where the final geographical area is the area calculated by said first calculation means when the weapon is fired.
2. A remote weapon system according to claim 1, wherein said input parameters further include ammunition type andor at least one climatic parameter.
3. A remote weapon system according to claim 1, wherein said at least one parameter defines said geographical area and comprises start angle in azimuth direction, stop angle in azimuth direction, minimum range, and maximum range.
4. A remote weapon system according to claim 1, wherein said position of the detected target is provided by a threat detection system.
5. A remote weapon system according to claim 1, wherein the fire control unit is configured to automatically calculate the number of shots of the weapon by dividing the total geographical area with a footprint of the current airburst ammunition type.
6. A remote weapon system according to claim 1, wherein the fire control unit is configured to automatically calculate azimuth and elevation directions of the mechanical support for each shot by applying a predefined firing pattern over the geographical area, which predefined firing pattern indicates distance and azimuth direction for a number of shots of the predefined firing pattern falling within the geographical area.
7. A remote weapon system according to claim 1, wherein said input parameters further include a height parameter representing a target altitude or a detonation height above the target, and wherein the fire control unit is configured to automatically adjust the elevation direction(s) in accordance with this height parameter.
8. A fire control unit for controlling a remote weapon station, wherein the fire control unit comprises:
input means for receiving input parameters including at least one parameter related to a position of a detected target;
first calculation means for continuously calculating a dynamically variable geographical area to be covered by the airburst ammunition from said weapon based on a speed of the detected target and calculation of movement of the detected target starting from the position of the detected target; and
second calculation means for automatically calculating a number of shots to be fired by the weapon and azimuth and elevation directions for each of the shots to be fired based on said input parameters such that substantially an entire final geographical area is covered by the airburst ammunition, where the final geographical area is the area calculated by said first calculation means when the weapon is fired.
9. An airburst control method, comprising:
receiving input parameters including at least one parameter related to a position of a detected target;
continuously calculating a dynamically variable geographical area to be covered by the airburst ammunition from said weapon based on a speed of the detected target and calculation of movement of the detected target starting from the position of the detected target; and
automatically calculating a number of shots to be fired by the weapon and azimuth and elevation directions for each of the shots to be fired based on said input parameters such that substantially an entire final geographical area is covered by the airburst ammunition, where the final geographical area is the area calculated by said first calculation means when the weapon is fired.
10. A non-transient computer storage medium storing a computer program product comprising instructions for causing a computer to perform the method of claim 9 when the product is executed on the computer.