Differential Dynamic Memory Scanning for Zero-Day Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures struggle to provide effective zero-day/zero-hour protection against rapidly morphing malware threats, and there is a need for improved malware detection efficacy, attribution, and scoring in cloud-based systems.
Innovation Solution
The implementation of differential dynamic memory scanning, which involves performing baseline memory scans of programs, storing data on memory regions, and conducting subsequent memory scans to detect modifications, thereby monitoring altered memory regions for potential malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware detection methods are used, then detection speed is limited, but system resource consumption is reduced; however, this results in inadequate zero-day protection against rapidly morphing malware threats
Solution Approach 1:
The system performs preliminary actions by establishing baseline memory scans before malware execution and pre-defining memory region categories with expected behaviors. This preliminary characterization enables rapid comparison during actual malware detection, achieving both high reliability and fast detection speed for zero-day threats
Solution Approach 2:
The system dynamically adjusts detection parameters by performing multiple subsequent memory scans at different stages of program execution and adapting scan intensity based on detected modifications. This dynamic approach improves detection efficacy while optimizing resource usage over time
2Measurement precision
If comprehensive memory scanning is performed to improve malware detection, then detection precision is improved, but system performance and processing time increase
Solution Approach 1:
The system segments memory into distinct regions (stack, heap, code segments, data segments) and applies targeted scanning strategies to each region based on expected behaviors. This segmentation maintains high detection precision by focusing on suspicious regions while improving overall system processing efficiency through selective scanning
Solution Approach 2:
The system applies different scanning intensities and criteria to different memory regions based on their local characteristics and expected behaviors. Critical regions with unexpected modifications receive intensive scanning, while stable regions receive minimal scanning, optimizing the balance between precision and efficiency
3Reliability
If frequent memory scans are conducted to detect rapid malware morphing, then threat detection capability is improved, but computational overhead and resource consumption increase
Solution Approach 1:
The system performs memory scans periodically at defined intervals and at specific execution points during program runtime. This periodic scanning maintains reliable threat detection capability while significantly reducing computational overhead compared to continuous scanning, as scans are concentrated at critical moments when malware behavior is most detectable
Data Source
AI summary
Systems and methods for differential dynamic memory scanning include, responsive to execution of a program, performing a baseline memory scan of the program; storing data associated with a plurality of memory regions of the program based on the baseline memory scan; performing one or more subsequent memory scans of the program during execution of the program to determine if one or more of the plurality of memory regions incurred a modification; and monitoring one or more altered memory regions based thereon.