Hooking Download Functions to Block Malware via Return Address Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Modern computer systems face challenges in detecting and preventing surreptitious downloads of malicious software due to the increasing complexity of polymorphic viruses and the time lag in signature-based detection systems, which allows malware to go undetected until a signature is developed and incorporated into scanning software.
Innovation Solution
A method that hooks downloading functions and examines the return addresses of called functions to determine if they are within the heap, performing remedial actions to prevent unauthorized data downloads, thus focusing on general malware behavior rather than signature-based detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection systems are used to detect malware, then detection accuracy for known malware is improved, but detection time lag increases allowing new polymorphic malware to go undetected
Solution Approach 1:
Instead of detecting malware by its signature (what it is), the invention detects malware by what it does - specifically by monitoring return addresses of downloaded code. This behavioral approach inverts the traditional detection paradigm, allowing immediate detection of malicious downloads without waiting for signature development.
Solution Approach 2:
The invention introduces an intermediary monitoring layer that hooks into the downloading function to examine return addresses. This intermediary checks whether downloaded code attempts to execute with heap addresses as return addresses, providing an additional detection mechanism that operates independently of signature-based systems.
2Reliability
If signature-based malware scanning software is used, then known malware can be detected, but new polymorphic viruses cannot be detected until signatures are developed
Solution Approach 1:
The invention changes the detection parameter from static signature matching to dynamic behavioral analysis. By monitoring runtime behavior (return addresses of downloaded code), the system adapts to new malware variants without requiring updated signatures, as the malicious behavior pattern remains consistent across variants.
Solution Approach 2:
The system performs preliminary monitoring of downloading functions before malware can execute its malicious payload. By hooking the downloading function and examining return addresses in advance, the system prevents malware execution before it can establish its presence or modify its behavior.
3Adaptability or versatility
If heap memory is used for dynamic memory allocation, then program flexibility is improved, but security risk increases when malware exploits heap addresses as return addresses
Solution Approach 1:
The invention applies preliminary anti-action by preemptively blocking downloads that attempt to use heap addresses as return addresses. This preventive measure counteracts the potential security vulnerability before malware can exploit it, while maintaining the legitimate uses of heap memory allocation.
Solution Approach 2:
The invention converts the potential harm of heap memory usage into a beneficial security feature. By monitoring and blocking malicious patterns (heap addresses as return addresses) while allowing legitimate heap usage, the system transforms the previously vulnerable heap mechanism into an active security monitoring point.
Data Source
AI summary
A hook is set for one or more downloading functions. Subsequently, code is executed within an application process. Responsive to the executed code calling one of the hooked functions, a return address of the called function is examined. If the return address is within a heap memory area of the application process, a remedial action, such as returning an error code or displaying an alert, is taken.