Detecting Modified Executable Code via PMU Dirty Bit Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods are ineffective in identifying modifications to executable code during execution, particularly for polymorphic and packed malware, which evade detection by changing signatures or using encryption, and lack effective runtime re-evaluation techniques.
Innovation Solution
The use of a Performance Monitoring Unit (PMU) to track modifications to executable pages by setting a dirty bit in page table entries, generating near real-time triggers for reputation and scanning engines when code is modified, and employing a software driver to monitor PMU-generated traps and track changes in the page's state.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If file inspection and behavioral monitoring are used to detect malware, then detection capability is improved, but malware can evade detection by changing signatures or using encryption
Solution Approach 1:
The system transitions from static file inspection to dynamic runtime monitoring. By installing hooks in the operating system kernel that activate during program execution, the system can detect code modifications as they occur, countering malware that changes its signature or structure during runtime.
Solution Approach 2:
The system performs preliminary setup by installing detection hooks in the OS kernel before malware execution. These hooks are positioned to intercept code page modifications, allowing the system to detect and respond to malware changes before they complete their evasion tactics.
2Measurement precision
If sandboxing is used to detonate binaries for detection, then packed malware can be uncovered, but advanced packers use time bombs and environment awareness to render such techniques ineffective
Solution Approach 1:
The system uses the OS kernel as an intermediary between the malware and the detection mechanism. By placing hooks in the kernel's memory management code, the system detects code modifications at the fundamental level without requiring complex sandboxing environments or understanding of specific packer techniques.
3Measurement precision
If runtime monitoring is implemented to detect code modifications, then malware execution can be detected, but system performance may be degraded
Solution Approach 1:
The detection functionality is extracted into the OS kernel where it operates at a fundamental level. By monitoring code page dirty bits in the kernel's memory management structures, the system detects modifications without requiring additional overhead in user-space monitoring applications.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A technique for detecting malware uses hardware capabilities of the processing element of a programmable device to detect modification of executable code during execution. By monitoring a dirty bit in page tables, pages that have been modified can be detected, allowing analysis of those pages during execution. An indication may then be passed to an anti-malware software to analyze the executable further.