Fileless Malware Detection via Memory Page Table Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods fail to effectively detect fileless malware, as these malicious programs execute in memory without being written to disk, evading traditional antivirus detection.
Innovation Solution
A system and method for fileless malware detection that intercepts executable code in memory, checks the NX bit in Page Table Entries, and analyzes executable code for maliciousness, using a Check-on-Execute mechanism to suspend execution and scan code before allowing execution based on scan results.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus software is used to scan files on disk, then file-based malware can be detected, but fileless malware executing in memory cannot be detected
Solution Approach 1:
The patent transitions detection from the traditional file system dimension to the memory execution dimension. By intercepting executable code in memory at the page table level and analyzing it before execution, the system detects malware in the dimension where fileless attacks actually operate, rather than relying solely on disk-based scanning.
Solution Approach 2:
The patent introduces an intermediary detection layer between the memory and the CPU execution unit. The check program acts as a mediator that intercepts executable code, performs security analysis, and decides whether to allow execution based on the analysis results, without disrupting normal system operation.
2Measurement precision
If executable code is intercepted and analyzed before execution, then malware detection accuracy improves, but system execution speed decreases
Solution Approach 1:
The patent performs security analysis in advance by intercepting executable code at the page table entry level before it reaches the CPU for execution. This preliminary action allows the system to identify and block malicious code before it can execute, preventing security incidents rather than responding to them after execution.
Solution Approach 2:
The patent applies selective analysis only to specific memory pages that contain executable code, rather than scanning entire memory or all code. By focusing analysis on local executable sections identified through page table interception, the system maintains high detection accuracy while minimizing impact on overall execution speed.
3Reliability
If NX bit checking is implemented to detect fileless malware, then detection rate increases, but system complexity increases
Solution Approach 1:
The patent leverages the existing NX bit mechanism that is already part of the system's memory management infrastructure. Rather than introducing a completely new detection mechanism, the system repurposes the existing page table and NX bit functionality to enable malware detection, reducing the need for additional complex components.
Solution Approach 2:
The patent makes the page table and NX bit mechanism serve dual purposes: their original function of memory management and protection, plus the additional function of malware detection. This multi-functionality allows the system to gain detection capabilities without adding separate dedicated detection hardware or software components.
Data Source
AI summary
The present disclosure provides a system and a method of fileless malware detection, and the method of the fileless malware detection includes steps as follows. The execution of the writable section in the memory is intercepted; the executable code corresponding to the execution is extracted from the writable section; whether the executable code is malicious is analyzed.