Hollowing Attack Detection via Memory Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting hollowing attacks, which involve process code substitution, often result in false positives and compatibility issues with other applications, including data protection systems, due to the use of hooks that alter the controlled application.
Innovation Solution
A system and method that monitor real-time process memory parameters of a target process, compare them with reference parameters stored in system storage, and detect hollowing attacks without using hooks that change the controlled application, thereby preventing false positives and ensuring compatibility.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If request interception techniques (API interceptions, injections, and hooks) are used to detect hollowing attacks, then detection capability is improved, but false positives increase and compatibility with other applications deteriorates
Solution Approach 1:
The patent creates a copy of the original executable file and compares the process memory against this copy. This allows detection of hollowing attacks by identifying discrepancies between the expected process memory content and actual content, without using hooks that cause false positives. The comparison mechanism achieves reliable detection while maintaining compatibility with other applications.
2Measurement precision
If hooks are used to control application execution for detecting code substitution, then detection accuracy is improved, but device complexity and compatibility issues increase
Solution Approach 1:
The patent extracts the detection logic from hook-based mechanisms and implements it through direct memory comparison. By removing the need for hooks, injections, and API interceptions, the system achieves detection accuracy through a simpler approach that compares process memory against a copy of the original executable, thereby reducing device complexity and improving compatibility.
3Ease of operation
If memory allocation techniques are used to control user actions, then application control capability is improved, but compatibility with data protection applications deteriorates
Solution Approach 1:
The patent uses a copy of the original executable file as a reference for comparison against process memory. This copying approach enables application control capability by identifying unauthorized modifications without interfering with data protection applications, thereby maintaining compatibility while achieving effective control.
Data Source
AI summary
System and method for detecting and curing a hollowing attack is disclosed herein. The method comprises monitoring real-time process memory parameters of a target process; retrieving real-time process memory parameters of the target process; comparing the real-time process memory parameters of the target process with reference process parameters of the target process stored in a system storage of the computing system and parameters of the process creation call-back notification; detecting a hollowing attack based on the comparison in previous step; in response to detecting the hollowing attack, determining a threat source file of malicious code; determining address space of the hollowed process on the computing system based on system log data; and curing the computing system by blocking execution of the threat source file and deleting threat resources associated therewith from the computing system.