System and method used for detecting malicious code of random access memory

Abstract

The invention discloses a system and a method used for detecting malicious code of a random access memory. The embodiment is characterized in that a hardware processor is used to detect the process of the untrusted application; the hardware processor is used to identify the function call including the inter-process function call from the generating of the process to the target process generated by the process of the untrusted application; the hardware processor is used to determine whether the execute the malicious software analysis executing the code in the address space of the target process called by the inter-process function generated by the process of the untrusted application; when the malicious software analysis is decided to be executed, the anti-virus software executed by the hardware processor can be used to analyze the code in the address space of the target process called by the inter-process function generated by the process of the untrusted application.

Description

technical field [0001] The present invention relates generally to the field of computer security, and more particularly to systems and methods for detecting malicious code in random access memory. Background technique [0002] The number of software applications is growing at enormous pace. Among various applications, there are many malicious programs (malware) that cause harm to computers or computer users, such as worms, keyloggers and computer viruses. There are also many techniques for providing security to computers, such as antivirus software, which are designed to detect malicious programs, as well as limit their operability (eg, place them in quarantine or completely remove them from the computer). [0003] However, there are various methods used by developers of malicious programs to hide the malware's activity from antivirus applications. Depending on the method used by the antivirus application for detecting malware, e.g., signature analysis (searching for a cor...

AI Technical Summary

Problems solved by technology

[0005] Although the above approaches address certain problems in the field of detection of malicious code in the address space of trusted processes, they are not effective enough to solve the problem: the mentioned approaches require access to several possible actions of the third-party process (including operations performed by trusted processes), or they investigate a limited combination of situations, for which the address space of a process needs to be inspected to reveal malicious code

Images