Auditor Process for Physical Memory Evasive Program Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for detecting unauthorized programs are resource-intensive, vulnerable to evasion by sophisticated malware, and can fail to detect new instances or intentionally hidden malware, posing privacy and detection challenges, especially on devices with limited resources.
Innovation Solution
A device auditing process that involves modifying physical memory and verifying results through a verifier, which can detect and remove evasive programs by checking for unauthorized modifications and performing additional scans, while minimizing resource usage and privacy concerns.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional scanning techniques are used to detect unauthorized programs, then detection capability is provided, but resource consumption (memory, processing power, battery) increases significantly
Solution Approach 1:
The patent applies preliminary action by having the auditor process clear physical memory of all programs except itself before execution, and by having the verifier pre-establish expected modification sequences and timing parameters. This prevents malware from hiding in memory during detection, eliminating the need for continuous resource-intensive scanning while maintaining detection reliability.
Solution Approach 2:
The patent extracts the detection function from traditional continuous scanning approaches and implements it through a dedicated auditor process that operates in a controlled, resource-efficient manner. The auditor is given exclusive access to physical memory and performs detection by comparing actual modifications against pre-established expected sequences, rather than continuously monitoring all system activities.
2Reliability
If detailed logs of device activities are compiled for centralized analysis, then unauthorized program detection is improved, but privacy concerns and resource consumption increase
Solution Approach 1:
The patent introduces an intermediary auditor process that acts as a trusted mediator between the device and verifier. The auditor directly observes physical memory states and modification sequences without accessing or logging user application data. This intermediary approach enables accurate detection of unauthorized programs while preserving user privacy, as the auditor only monitors system-level memory modifications rather than user activities.
3Reliability
If memory is cleared before auditor execution to remove malware, then evasive program detection is improved, but legitimate programs may also be removed
Solution Approach 1:
The patent applies preliminary action by having the auditor process clear physical memory of all programs except itself before execution. This clearing happens once at the start of the auditing session, not continuously. The auditor then executes in this controlled environment and compares observed modifications against pre-established expected sequences, allowing detection of evasive programs without repeatedly clearing and losing legitimate programs.
Solution Approach 2:
The patent implements feedback through the verifier that compares the sequence and timing of memory modifications against pre-established expected values. If modifications match expected patterns, legitimate programs are confirmed. If deviations occur, evasive programs are detected. This feedback mechanism distinguishes between legitimate and malicious modifications without requiring continuous memory clearing.
4Reliability
If rootkit detection techniques are used to identify hidden malware, then detection capability is improved, but vulnerability to sophisticated evasion methods increases
Solution Approach 1:
The patent replaces traditional software-based detection mechanisms with a hardware-level approach by directly monitoring physical memory modifications. Instead of relying on software hooks that can be bypassed by rootkits, the auditor process directly observes memory state changes at the hardware level. This substitution makes detection more difficult to evade, as malware would need to manipulate physical memory hardware rather than just software interfaces.
Solution Approach 2:
The patent applies preliminary action by establishing the auditor process with direct physical memory access before any malware can intervene. The auditor then monitors the entire execution sequence from a known good state, comparing observed modifications against pre-established expected sequences. This approach detects rootkits by identifying any unauthorized modifications to the expected sequence, making evasion extremely difficult.
Data Source
AI summary
Auditing a device is disclosed. One or more hardware parameters that correspond to a hardware configuration is received. A sequence of modifications to the physical memory is performed. Results are provided to a verifier. Optionally, once it is determined that no evasive software is active in the physical memory, a scan is performed.