Function Hook Malware Detection in Shared Libraries
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies struggle to detect and locate obfuscated and dormant malware in memory, as conventional methods fail to identify these hidden malicious artifacts effectively.
Innovation Solution
An apparatus and method that involve inserting a function hook into a shared library when it is loaded into memory, allowing the processor to pause execution and scan a range of memory addresses to detect and locate potentially malicious processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional detection methods are used, then system simplicity is maintained, but malware detection capability deteriorates
Solution Approach 1:
The patent applies preliminary action by inserting function hooks into shared libraries before malware execution can occur. The hooking mechanism is established in advance, allowing the system to intercept and analyze function calls before malicious code executes, thereby detecting malware without requiring complex real-time analysis systems.
Solution Approach 2:
The patent uses function hooks as intermediary elements between the malware and the detection system. These hooks act as mediators that intercept function calls, transfer control to analysis routines, and enable detection without directly confronting the malicious code, thus simplifying the overall detection architecture while improving reliability.
2Measurement precision
If memory scanning is performed continuously, then malware detection accuracy is improved, but system performance deteriorates
Solution Approach 1:
The patent implements periodic action by triggering memory scanning only at specific intervals and conditions rather than continuously. The system scans memory addresses when function hooks are activated, which occurs periodically based on malware execution patterns, thereby maintaining detection accuracy while minimizing impact on system performance during normal operation.
Solution Approach 2:
The patent applies local quality by focusing memory scanning on specific address ranges and locations rather than scanning the entire memory space continuously. The scanning activity is concentrated on areas where malware is most likely to reside, improving accuracy while reducing the overall scanning burden and maintaining system productivity.
3Reliability
If function hooks are inserted into shared libraries, then malware detection capability is improved, but system stability deteriorates
Solution Approach 1:
The patent extracts the detection functionality from the main system execution flow by using separate analysis routines that are only activated when hooks are triggered. This extraction allows the detection mechanism to operate independently, improving malware detection capability while minimizing disruption to normal system stability and execution flow.
Solution Approach 2:
The patent applies preliminary anti-action by preparing rollback mechanisms and error handling routines that activate if function hooking causes system instability. These protective measures are established in advance to counteract potential negative effects of hooking, thereby maintaining system stability while enabling improved malware detection capability.
Data Source
AI summary
Embodiments disclosed herein include an apparatus with a processor configured to receive an indication of a function call to an identified shared library and configured to perform an identified function. The processor is configured to insert a function hook in the shared library. The function hook is configured to pause the execution of the shared library when called. In response to the function hook, the processor is configured to identify a source location in one or more memories associated with an origin of the function call to the shared library. The processor is configured to scan a range of memory addresses associated with the source location in the one or more memories, and identify, based on the scanning, a potentially malicious process within the range of memory addresses.