Predictive Heap Overflow Protection via Memory Allocation Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-malware solutions are ineffective in detecting new or morphed malware, particularly in zero-day attacks, as they rely on signature matching and struggle with polymorphic executables, leading to failures in identifying heap overflow-based malware attacks.
Innovation Solution
A predictive heap overflow protection system that intercepts and analyzes data for memory allocation patterns, using a virtual machine and memory profiler to emulate execution and compare memory allocations against previous ones, determining malicious activity through checksum, size, entropy, and time comparisons, and reporting to anti-malware classifiers for further analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based anti-malware solutions are used, then detection of known malware is improved, but detection of new or morphed malware fails
Solution Approach 1:
The system performs preliminary analysis of memory allocation patterns during application execution to establish a baseline of normal behavior before malware can execute or morph. By monitoring allocations in advance and comparing against established patterns, the system detects anomalies that indicate new or modified malware without requiring prior signatures.
Solution Approach 2:
The patent replaces the mechanical signature-matching approach with a behavioral analysis system that monitors memory allocation dynamics. Instead of comparing static code signatures, the system observes runtime memory behavior patterns, substituting pattern recognition and statistical analysis for traditional signature-based detection mechanisms.
2Reliability
If resource-intensive signature-based scans are performed, then malware detection thoroughness is improved, but system performance deteriorates
Solution Approach 1:
The system extracts and monitors only the critical memory allocation behavior patterns from application execution, separating these key indicators from the rest of the application's operational data. By focusing solely on allocation size, frequency, and timing patterns, the system achieves thorough malware detection without the computational overhead of analyzing entire application behaviors or performing exhaustive signature scans.
Solution Approach 2:
The system applies partial monitoring by selectively tracking memory allocation events that are most indicative of malware behavior, rather than comprehensively analyzing all application operations. This targeted approach provides sufficient detection capability while maintaining system performance by avoiding excessive monitoring of non-critical operations.
3Reliability
If memory allocation monitoring is implemented, then heap overflow attack detection is improved, but system complexity increases
Solution Approach 1:
The memory allocation monitoring system serves multiple functions simultaneously: it detects heap overflow attacks, identifies malware execution, and establishes behavioral baselines for future comparisons. By making the monitoring mechanism universal and multi-purpose, the system reduces overall complexity compared to implementing separate specialized detectors for each threat type.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for preventing malware attacks includes identifying a set of data whose malware status is not known to be safe, launching an application using the data, determining that one or more prior memory allocations have been created by the application, determining that a new memory allocation has been created by the application, comparing the new memory allocation to the prior memory allocations, and based on the comparison, determining whether the data includes malware.