Code Injection for Endpoint Malware Remediation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems struggle to effectively remediate malware infections in running software at network endpoints, especially when malware alters kernel resources, as they often require execution despite known vulnerabilities and potential infection.
Innovation Solution
The technique involves injecting code into suspicious processes executing on a node within a micro-virtual machine (micro-VM) to monitor and remediate malicious behavior, restoring altered kernel resource states and providing dynamic, in-process vulnerability patching without changing the operating system image.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code injection is used to remediate malware in running software, then system reliability is improved, but device complexity increases
Solution Approach 1:
The patent introduces a code injection mechanism as an intermediary layer between the malware-infected process and the kernel resources. This intermediary injects remediation code into the suspicious process to reverse malicious changes to kernel data structures, thereby restoring system reliability without requiring full system shutdown or reboot.
Solution Approach 2:
The system performs preliminary detection of malware behavior by monitoring process actions against kernel resources. Before the malware can cause significant damage, the system detects suspicious modifications and proactively injects remediation code to prevent or reverse the harmful effects, maintaining system integrity.
2Reliability
If malware detection systems monitor and remediate malicious behavior in real-time, then security effectiveness is improved, but processing time increases
Solution Approach 1:
The code injection mechanism enables the system to rapidly respond to detected malware behavior by directly injecting remediation code into the suspicious process. This approach skips traditional time-consuming remediation steps such as full system scans, process termination, or reboot sequences, allowing quick restoration of kernel resources while maintaining continuous system operation.
Data Source
AI summary
A technique injects code into a suspicious process containing malware executing on a node to enable remediation at the node. Illustratively, the technique may inject code into the suspicious process during instrumentation of the malware in a micro-virtual machine (VM) to monitor malicious behavior and to enable remediation of that behavior at a node embodied as an endpoint. According to the technique, code may be injected into the suspicious process during instrumentation in the micro-VM of the endpoint to restore states of kernel resources (e.g., memory) that may be infected (i.e., altered) by behavior (actions) of the malware.