Detecting Malware via Dynamic Memory Function Pointer Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods are ineffective against obfuscated malware that uses dynamically generated function pointers to evade detection, as they rely on binary code analysis and cannot efficiently scan memory for such pointers.
Innovation Solution
Implementing a technique to scan process memory for dynamically generated function pointers, using a concurrent search algorithm to efficiently identify and filter out obfuscated system function calls, thereby detecting malicious intent and capability of malware samples.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware uses dynamically generated function pointers to obfuscate malicious code, then malware can evade detection by traditional binary code analysis, but detection precision deteriorates because conventional methods cannot identify concealed malicious intent
Solution Approach 1:
The patent applies dynamics by transitioning from static binary code analysis to dynamic runtime memory scanning. Instead of analyzing fixed executable code, the system monitors memory during execution to capture dynamically generated function pointers that only exist temporarily during runtime, thereby resolving the contradiction between detecting obfuscated malware and maintaining detection precision
Solution Approach 2:
The patent introduces a new dimension of detection by moving from code-level analysis to memory-level analysis. By scanning the process memory space where function pointers are dynamically constructed, the system adds a temporal and spatial dimension to malware detection, enabling identification of malicious intent that is invisible in static binary form
2Ease of manufacture
If traditional binary code analysis is used to detect malware, then detection methods are simple to implement, but productivity deteriorates because they cannot efficiently scan memory for dynamically generated pointers
Solution Approach 1:
The patent replaces the mechanical process of static binary analysis with an automated dynamic memory scanning system. By substituting manual or simple automated code review with runtime memory interception and pattern matching, the system dramatically improves detection efficiency while maintaining implementation feasibility through standardized scanning protocols
3Reliability
If comprehensive memory scanning is performed to detect all function pointers, then detection coverage is improved, but device complexity increases due to computational requirements for scanning entire memory spaces
Solution Approach 1:
The patent extracts only the critical portion of memory that contains function pointer data structures for scanning, rather than analyzing the entire memory space. By isolating and scanning only relevant memory regions where dynamically generated pointers are constructed, the system maintains comprehensive detection coverage while reducing computational complexity to manageable levels
Data Source
AI summary
Techniques for detecting malware via scanning for dynamically generated function pointers in memory are disclosed. In some embodiments, a system/process/computer program product for detecting malware via scanning for dynamically generated function pointers in memory includes detecting a dynamically generated function pointer in memory based on an analysis of monitored changes in memory during execution of a malware sample in a computing environment; and generating a signature based on detection of the dynamically generated function pointer in memory, wherein the malware sample was determined to be malicious.