Emulated Memory Segmentation for Malware Detection Accuracy
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods, including signature scanning and heuristic analysis, are inadequate in identifying unknown malware and can be hindered by the limited resources and capabilities of emulated computer systems, which may cause programs to behave differently than in real systems, leading to inaccurate assessments.
Innovation Solution
A method of emulating a program within an emulated computer system that copies and allows access to data from the real system's memory, using address translation and monitoring behavior to detect suspicious activities, ensuring accurate prediction of program behavior without risking the real system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a program is executed in an isolated emulated environment for malware detection, then the real computer system is protected from damage, but the emulated system has limited resources and capabilities that may cause the program to behave differently than in a real system
Solution Approach 1:
The patent segments the memory access functionality by separating the emulated memory from the real system memory. A copy mechanism is implemented where specific memory pages are copied from the real system into the emulated memory space, allowing the program to access real data while remaining in the protected emulated environment. This segmentation enables accurate behavioral detection without compromising system safety.
Solution Approach 2:
The patent introduces an intermediary layer (the copy mechanism) between the emulated program and the real system memory. This intermediary copies necessary data from the real system into the emulated environment, allowing the program to interact with realistic data while the emulated system maintains protection. The intermediary resolves the contradiction by providing both isolation and behavioral accuracy.
2Measurement precision
If signature scanning and heuristic analysis are used for malware detection, then known malware can be identified, but unknown malware programs remain undetected
Solution Approach 1:
The patent performs preliminary action by executing the program in an emulated environment before allowing it to run on the real system. During this preliminary execution, the system monitors program behavior, API calls, and memory access patterns to detect suspicious activities. This preliminary detection phase enables identification of both known and unknown malware based on behavioral characteristics rather than just signatures.
Solution Approach 2:
The patent implements feedback mechanisms where the emulated system continuously monitors program behavior and provides feedback about detected activities. The system tracks API calls, memory access patterns, and execution flow, comparing observed behavior against known malware patterns. This feedback loop enables dynamic detection that adapts to both known signatures and unknown behavioral patterns.
Data Source
AI summary
According to a first aspect of the present invention there is provided a method of performing emulation of at least part of a program using an emulated computer system implemented on a computer system. The method includes, during execution of the program within the emulated computer system, when the program attempts to access a unit of data, copying the unit of data from a memory of the computer system into an emulated memory, and allowing the program to access the unit of data within emulated computer system. A unit of data may be a memory page.