Hardware-Accelerated Malicious URL Detection Using Memory Features
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions for ransomware, malicious URLs, and DGA malware are insufficient as they rely on static analysis and external monitoring, making them ineffective against new and obfuscated threats, and they fail to detect malware when it is active in memory.
Innovation Solution
A hardware-accelerated security service on an integrated circuit extracts features from memory data using a machine learning detection system to identify malicious activity, including ransomware, malicious URLs, and DGA domains, operating as an agentless solution that detects these threats during their exposure in memory.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static analysis and external monitoring are used for security detection, then existing security solutions can be implemented, but they fail to detect new and obfuscated threats and cannot detect malware when active in memory
Solution Approach 1:
The system performs preliminary actions by extracting and analyzing memory contents before malware can execute or hide. The memory forensics component captures memory snapshots and extracts features proactively, enabling detection of malicious URLs and DGA domains before they cause harm, thus resolving the contradiction between reliability and adaptability.
Solution Approach 2:
The patent replaces traditional mechanical/static analysis methods with machine learning-based dynamic analysis. The ML model processes extracted memory features to classify malicious activity, providing adaptive detection capabilities that can identify new and obfuscated threats, thereby improving both reliability and versatility.
2Measurement precision
If machine learning models are used to detect malicious activity, then detection accuracy improves, but computational resources and processing time increase
Solution Approach 1:
The system extracts only the most relevant features from memory contents before feeding them to the ML model. By selecting and extracting key memory artifacts and their associated features, the system reduces the amount of data processed, thereby lowering computational resource consumption while maintaining high classification accuracy.
Solution Approach 2:
The detection pipeline is segmented into distinct stages: memory extraction, feature extraction, and ML classification. This segmentation allows each component to be optimized independently, reducing overall computational burden while maintaining precision through specialized processing at each stage.
3Speed
If real-time memory monitoring is implemented, then detection speed improves, but system complexity and overhead increase
Solution Approach 1:
The memory forensics component serves multiple functions: it extracts memory contents, identifies memory artifacts, and prepares data for ML analysis. This multi-functionality reduces the need for separate dedicated components, thereby reducing system complexity while maintaining real-time detection capability.
Solution Approach 2:
The feature extraction component acts as an intermediary between raw memory data and the ML model. It processes and transforms memory artifacts into suitable features, simplifying the interaction between components and reducing overall system complexity while enabling real-time processing.
Data Source
AI summary
Apparatuses, systems, and techniques for classifying a candidate uniform resource locator (URL) as a malicious URL using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service that obtains a snapshot of data stored in the physical memory and extracts a set of features from the snapshot. The security service classifies the candidate URL as a malicious URL using the set of features and outputs an indication of the malicious URL.