Boot-Time Memory Reservation Detection for Rootkit Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware solutions struggle to detect new or morphed malware, particularly rootkits, during zero-day attacks, as they rely on signature matching and may fail to recognize polymorphic executables, leading to missed detections.
Innovation Solution
A method and system that monitor memory access permissions during the boot process to identify reserved memory areas, which are indicative of malware, using anti-malware modules to evaluate lock status and entity permissions, and consult anti-malware rules or servers for determination, taking corrective actions as necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature matching is used to detect malware, then known malware can be identified, but new or morphed malware in zero-day attacks cannot be detected
Solution Approach 1:
The patent performs memory reservation detection during the boot process before the operating system fully loads and before malware can establish itself. By checking for unauthorized memory reservations in advance, the system can detect rootkits before they can disguise themselves or modify their behavior, enabling detection of new malware variants without relying on signatures.
Solution Approach 2:
The patent introduces a boot-time verification mechanism that acts as an intermediary between the hardware and the operating system. This intermediary layer checks memory reservation requests against a whitelist of authorized applications, providing an additional detection layer that can identify malicious memory allocations regardless of the malware's disguise or transformation.
2Reliability
If memory access permissions are monitored during boot process, then rootkits can be detected, but system complexity increases
Solution Approach 1:
The patent implements a universal whitelist mechanism that can be applied to all memory reservation requests during boot, regardless of the specific malware type or target. This single verification system handles multiple detection scenarios (different rootkit types, various memory allocation patterns) without requiring separate detection logic for each case, thereby reducing overall system complexity.
Solution Approach 2:
The system uses the operating system's own memory management structures and permission mechanisms to detect malware. By leveraging existing system components (memory managers, permission tables, boot processes) rather than introducing entirely new monitoring infrastructure, the patent reduces complexity while maintaining detection reliability.
3Reliability
If exclusive memory reservation is required for all applications, then security is improved, but legitimate applications may be blocked causing false positives
Solution Approach 1:
The patent pre-establishes a whitelist of authorized applications and their permitted memory reservations before the boot process completes. By having this authorization list ready in advance, the system can quickly verify memory allocation requests without blocking legitimate applications, reducing false positives while maintaining security against unauthorized reservations.
Solution Approach 2:
The system implements a feedback mechanism where memory reservation requests are verified against the whitelist, and the results are used to adjust detection sensitivity. When legitimate applications are identified through the whitelist, the system confirms their reservations without blocking, while unauthorized reservations are flagged for further investigation, thereby reducing false positives while maintaining high detection reliability.
Data Source
AI summary
A method for monitoring for malware includes, during a boot process on an electronic device, determining a portion of memory, determining that the portion of memory is reserved for exclusive access by an entity on the electronic device, and, based on the determination that a portion of memory is reserved for exclusive access during the boot process, determining that the reservation is indicative of malware.