Dynamic Memory Access Control for Exploit Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies face challenges in effectively preventing the execution of malicious code exploits, as exploit creators continually find ways to bypass existing protection methods, such as DEP and ASLR, leading to vulnerabilities in software applications.
Innovation Solution
A memory access control arrangement is implemented where write and execute privileges are enforced for allocated memory portions, with an interceptor module monitoring for exceptions and analyzing the presence of malicious code, preventing its execution if detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DEP (Data Execution Prevention) is used to mark memory as non-executable, then protection from buffer overflow attacks is improved, but exploit creators can find ways to bypass this protection
Solution Approach 1:
The system dynamically changes memory access permissions at runtime. Instead of static DEP markings, the system monitors memory access patterns and dynamically grants or revokes execute permissions based on detected behavior, making it adaptive to new exploit techniques while maintaining protection.
Solution Approach 2:
The system performs preliminary analysis of memory regions before allowing execution. By pre-checking memory contents and access patterns, the system can identify and block malicious code before it executes, preventing exploits from taking advantage of vulnerabilities.
2Reliability
If memory access control is strictly enforced with limited privileges, then security against malicious code is improved, but system complexity increases due to monitoring and exception handling
Solution Approach 1:
The system introduces an intermediary component that sits between the application and the memory access control mechanism. This intermediary handles the complex monitoring and exception processing, simplifying the overall system architecture while maintaining strict security controls through the mediating layer.
3Reliability
If write and execute privileges are disabled in memory regions, then protection against code execution is improved, but legitimate applications may be affected by false positives
Solution Approach 1:
The system implements feedback mechanisms that monitor application behavior and adjust memory permissions accordingly. By continuously observing access patterns and providing feedback to the permission management system, legitimate applications can maintain access while malicious code is blocked, reducing false positives.
Data Source
AI summary
Protection of a computer system against exploits. A computer system has a memory access control arrangement in which at least write and execute privileges are enforced for allocated portions of memory. An association of the process thread and the first portion of memory is recorded. A limited access regime in which one of the write and execute privileges is disabled, is established, and is monitored for any exceptions occurring due to attempted writing or execution in violation thereof. In response to the exception being determined as a write exception, the associated process thread is looked up, and analyzed for a presence of malicious code. In response to the exception type being determined as an execute exception, the first portion of memory is analyzed for a presence of malicious code. In response to detection of a presence of malicious code, execution of the malicious code is prevented.