Guard Pages for Application Execution Hijacking Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity measures, such as Data Execution Prevention (DEP) and Address Space Layout Randomization (ASLR), are vulnerable to bypasses like Return-Oriented Programming (ROP) and NOP sleds, allowing hackers to execute malicious shellcode and control application execution, necessitating a system to identify potential application-execution hijacking attacks.
Innovation Solution
A network appliance with a dynamic analysis server that monitors access events to guarded page areas of loaded modules, using virtual execution logic or direct communication of DLL/kernel logic to detect malicious access attempts, and applies guard pages or hardware breakpoints to prevent execution of malicious code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If DEP and ASLR are implemented to prevent code execution, then security is improved, but the system becomes vulnerable to bypasses like ROP and NOP sleds
Solution Approach 1:
The patent applies preliminary action by establishing guard pages at critical memory locations (base addresses of loaded modules, import tables, process environment blocks) before any potential attack can occur. These guard pages are configured to trigger exceptions on any access attempt, creating a preventive barrier that detects and blocks ROP gadget retrieval and shellcode execution attempts before they can succeed.
Solution Approach 2:
The patent introduces guard pages as intermediary elements between legitimate memory regions and potential attack vectors. These guard pages act as mediators that intercept and block unauthorized access attempts, specifically preventing the retrieval of ROP gadgets and the execution of shellcode by generating exceptions before the actual malicious execution can occur.
2Difficulty of detecting and measuring
If guard pages are added to detect ROP gadgets and shellcode execution, then detection capability is improved, but device complexity increases
Solution Approach 1:
The patent applies universality by configuring the guard pages to serve multiple detection functions simultaneously. A single guard page at a module's base address can detect both ROP gadget retrieval attempts and shellcode execution attempts. The same mechanism works across different memory regions (import tables, process environment blocks), providing multi-functional detection without requiring separate specialized detectors for each attack vector.
Solution Approach 2:
The patent implements self-service by leveraging the operating system's existing exception handling mechanisms to perform detection. The guard pages automatically trigger exceptions on unauthorized access, and the OS's standard exception processing infrastructure handles the detection and response. This eliminates the need for custom detection code or additional complexity in the security system, as the existing OS infrastructure serves the detection function.
3Measurement precision
If guard pages are applied to multiple memory regions, then detection accuracy is improved, but performance overhead increases
Solution Approach 1:
The patent applies local quality by selectively placing guard pages only at specific critical memory regions where ROP gadgets and shellcode are most likely to be found. Rather than protecting every memory region, the guard pages are strategically positioned at module base addresses, import tables, and process environment blocks - the locations most relevant to ROP attacks. This targeted approach maintains high detection accuracy for the most critical attack vectors while minimizing the overhead of protecting less relevant memory regions.
Data Source
AI summary
According to one embodiment, a malware detection software being loaded into non-transitory computer readable medium for execution by a processor. The malware detection software comprises exploit detection logic, rule-matching logic, reporting logic and user interface logic. The exploit detection logic is configured to execute certain event logic with respect to a loaded module. The rule-matching logic includes detection logic that is configured to determine whether an access source is attempting to access a protected region and determine whether the access source is from a dynamically allocated memory. The reporting logic includes alert generating logic that is configured to generate an alert while the user interface logic is configured to notify a user or a network administrator of a potential cybersecurity attack.