Event Tracing Malware Detection via Orphan Page Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems are invasive, resource-intensive, and often fail to detect unknown malware variants, as they rely on signature-based detection or controlled environment emulation, which can cause compatibility issues and performance bottlenecks, and are not effective in identifying arbitrary code execution in processes like document viewers or browsers.
Innovation Solution
A communication system that uses event tracing features of the operating system to identify memory regions executed by a target process, determining if code is running from unidentified or unusual regions, without requiring controlled environments or OS control flow interception, leveraging Microsoft Windows features like ETW profiling events to provide transparent and asynchronous detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection or controlled environment emulation is used, then malware detection capability is improved, but system performance and compatibility deteriorate
Solution Approach 1:
The patent extracts the detection function from the target application process and implements it as a separate kernel-level driver. The driver independently monitors process behavior, memory allocations, and API calls without requiring the application to run in a controlled environment, thus eliminating performance overhead while maintaining detection capability
Solution Approach 2:
The patent introduces a kernel-mode driver as an intermediary between the operating system kernel and user-space applications. This driver acts as a mediator that captures system calls and process events transparently, enabling detection without modifying or controlling the target application's execution environment
2Reliability
If controlled environment emulation is used, then malware detection capability is improved, but compatibility and ease of operation worsen
Solution Approach 1:
The patent enables the target application to continue running normally in its native environment while the kernel driver independently performs detection functions. The application serves itself by executing normally, while the driver simultaneously monitors for malicious behavior, eliminating compatibility issues associated with controlled environments
3Reliability
If invasive detection methods are used, then malware detection capability is improved, but system resource consumption worsens
Solution Approach 1:
The patent implements selective monitoring that focuses detection resources only on suspicious processes or specific high-risk operations. The kernel driver dynamically adjusts monitoring intensity based on risk assessment, applying partial action to low-risk processes and excessive action to high-risk targets, optimizing resource utilization
Data Source
AI summary
Particular embodiments described herein provide for an electronic device that can be configured to execute an application in a system with an operating system, perform event tracing for the application, analyze each instruction pointer from the event tracing, and determine if an instruction pointer points to an orphan page of memory. The orphan page can be a region of code that is not associated with the application, a region of code that is unidentified, or unusual code that is not associated with the application. In addition, the event tracing can be an embedded application that is part of the operating system.