Below-OS Security Agent for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional anti-malware security techniques are limited in detecting and neutralizing self-modifying malware, as they operate within the same execution priority as the operating system, making them susceptible to evasion by kernel mode malware, which can hide its presence and modify itself to avoid detection.
Innovation Solution
Implementing a below-operating system security agent that traps and analyzes memory accesses to detect suspicious behavior, records access history, and modifies malicious code to prevent its execution, operating at a higher priority than the operating system to avoid malware detection evasion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anti-malware security techniques operate within the operating system kernel level, then they can access and modify malware processes, but they become susceptible to evasion by kernel mode malware that operates at the same execution priority
Solution Approach 1:
The patent transitions the security agent from operating at the same execution priority level as the operating system (kernel mode) to operating below it (firmware or hypervisor level). This dimensional change in execution priority creates a hierarchical advantage where the security agent can observe and control malware processes without being subject to the same evasion techniques that work at the kernel level.
Solution Approach 2:
The security agent performs preliminary actions by establishing its monitoring and control mechanisms before malware can execute its evasion tactics. By operating at a lower execution priority level, the agent can trap and log memory access attempts before the malware has opportunity to modify itself or detect the security measures.
2Reliability
If security software filters all behaviors of an electronic device, then it can detect malicious actions, but it consumes significant system resources and may interfere with normal operations
Solution Approach 1:
The security agent applies local quality by focusing its monitoring efforts on specific memory access patterns and behaviors that are indicative of malware activity, rather than filtering all device behaviors uniformly. This targeted approach allows effective malware detection while minimizing interference with normal system operations.
Solution Approach 2:
The security agent acts as an intermediary layer between the hardware and the operating system, intercepting and analyzing memory access attempts. This intermediary position allows it to detect malicious behavior without requiring direct intervention in all system operations, thereby maintaining system performance.
3Adaptability or versatility
If malware modifies its binary components to avoid detection, then it can escape signature-based detection, but it requires additional mechanisms to dynamically change its code
Solution Approach 1:
The security agent implements feedback mechanisms by continuously monitoring memory access patterns and comparing them against known malware behaviors. When suspicious patterns are detected, the agent can respond by blocking the modification attempts or alerting the system, creating a feedback loop that adapts to evolving malware techniques without requiring complex signature updates.
Solution Approach 2:
The patent replaces traditional mechanical signature-based detection with a behavioral analysis approach. Instead of relying on static binary signatures that malware can easily bypass, the system monitors dynamic memory access patterns and behaviors, substituting the mechanical signature matching process with more sophisticated behavioral observation that is harder for malware to evade.
4Reliability
If anti-malware applications use operating system functions to erase or neutralize malware, then they can remove threats, but sophisticated malware can detect and track these techniques to avoid neutralization
Solution Approach 1:
The security agent operates from a different dimensional level (below the operating system) when neutralizing malware. This allows it to erase or block malicious code without triggering the detection mechanisms that malware has prepared to counter operating system-level anti-malware functions. The neutralization action occurs in a different execution context that malware cannot easily monitor or respond to.
Data Source
AI summary
A system for securing an electronic device, may include a memory, a processor, one or more operating systems residing in the memory for execution by the processor; and a security agent configured to execute on the electronic device at a level below all of the operating systems of the electronic device accessing the memory. The security agent may be further configured to detect presence of malicious code, and in response to detecting presence of the malicious code, modify the malicious code.