Anomaly Detection via Dynamic Memory Scanning and Asset Normalization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for computer network management often resort to brute force approaches that result in unnecessary downtime and data loss, as they fail to accurately detect and address specific anomalies, particularly malware and user-specific issues, due to limitations in static scanning and staff resources.
Innovation Solution
A system and method for detecting anomalies in computer networks by generating an asset normalization model from snapshots, combining static and dynamic scanning techniques to identify and remediate issues such as missing or corrupted files, registry keys, and software exploitation, using adaptive reference models and real-time memory scanning to provide automated support and remediation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static scanning is used to detect configuration anomalies, then the scanning process is simple and manageable, but malware outside the static scope cannot be detected and the scan scope can be viewed and bypassed by users
Solution Approach 1:
The patent transitions from static scanning to dynamic scanning by injecting a scanner DLL into target processes. The scan scope is dynamically determined based on process memory contents rather than a predetermined static list, allowing the system to adapt to different runtime environments and detect malware that would be invisible to static scanning approaches.
Solution Approach 2:
The patent introduces a scanner DLL as an intermediary component that is injected into target processes. This DLL acts as a mediator between the scanning system and the process memory, enabling deep inspection of process contents while maintaining system stability and providing encrypted communication channels that prevent user bypass.
2Productivity
If brute force methodologies are used for problem remediation, then staff resources are conserved, but user data may be lost and unnecessary downtime occurs
Solution Approach 1:
The patent performs preliminary anomaly detection and root cause analysis before remediation actions are taken. By identifying specific issues such as missing files, corrupted registry keys, or malware infections beforehand, the system can apply targeted repairs rather than blanket re-imaging, thereby preserving user data and minimizing downtime while maintaining staff resource efficiency.
Solution Approach 2:
The patent applies localized remediation targeted at specific anomalies rather than global re-imaging. Each detected issue (e.g., a specific missing file, a corrupted registry key, or a malware infection in a particular process) receives a tailored repair action, preserving unaffected user data and applications while resolving only the specific problems identified.
3Measurement precision
If comprehensive scanning is performed to detect all potential issues, then detection accuracy is improved, but system performance and user productivity deteriorate due to scanning overhead
Solution Approach 1:
The patent implements periodic scanning at strategically chosen intervals rather than continuous scanning. The system scans process memory at key events such as process startup, before and after critical operations, or at scheduled intervals, thereby achieving comprehensive anomaly detection while minimizing performance interference with user productivity during normal operations.
Solution Approach 2:
The patent performs scanning selectively on process memory contents rather than scanning the entire system continuously. By focusing scanning resources on specific processes, memory regions, or time windows when anomalies are most likely to manifest, the system achieves high detection accuracy while limiting the performance overhead to acceptable levels that do not significantly impact user productivity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems and methods are provided for detecting an anomaly in a computer that is part of a population of networked computers. Snapshots are received from a plurality of computers within the population of computers, where individual snapshots include a state of assets and runtime processes of a respective computer. An asset normalization model is generated from the snapshots and serves as a baseline model for detecting an anomaly in the state of assets and runtime processes of a respective computer. A snapshot from at least one of the computers is compared to the asset normalization model in order to determine whether an anomaly is present in a state of static assets and runtime processes of the at least one of the computers.