Hypervisor Buffer Overflow Detection via Memory Page Identifier Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Native operating systems' limited filtering capabilities allow malware to operate at the same level as security software, compromising both the OS and security software integrity, with kernel mode malware hiding their presence and attacking anti-malware applications by tampering with user mode memory.
Innovation Solution
A hypervisor-based system with an anti-malware module operating below the operating system level, trapping unauthorized memory accesses and using memory maps and rules to differentiate between authorized and unauthorized operations, preventing buffer overflows and malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security software operates within the native operating system kernel, then it can filter and monitor system behaviors, but malware at the same kernel level can compromise both the OS and security software integrity
Solution Approach 1:
The patent introduces a new hierarchical dimension by implementing a hypervisor-based security system that operates below the native operating system kernel. This creates a layered architecture where the hypervisor (Ring -1) provides security monitoring at a lower privilege level than the OS kernel (Ring 0), allowing security software to observe and filter kernel-mode malware activities without being vulnerable to them. The hypervisor intercepts memory access requests before they reach the OS, enabling detection of buffer overflows and malicious code injections that would otherwise compromise security software integrity.
2Adaptability or versatility
If the operating system provides filtering functionality, then it can prevent some malicious activities, but the filtering is limited and only available on timelines decided by the operating system vendor
Solution Approach 1:
The patent introduces the hypervisor as an intermediary layer between hardware and the native operating system. This intermediary provides enhanced filtering capabilities by intercepting and analyzing memory access requests before they reach the OS kernel. The hypervisor's filter driver monitors buffer allocations, tracks memory access patterns, and detects malicious activities such as buffer overflows and code injections. This intermediary approach extends filtering versatility beyond OS vendor limitations while maintaining system integrity through the hypervisor's lower-level positioning.
3Reliability
If kernel mode malware tamper with user mode memory to inject malicious code, then they can alter execution paths and redirect into malicious code, but a hypervisor-based system can intercept and prevent these unauthorized accesses
Solution Approach 1:
The patent implements preliminary action by having the hypervisor pre-allocate and pre-monitor buffer memory regions before the native operating system uses them. The hypervisor's filter driver establishes tracking mechanisms in advance, recording buffer allocations, sizes, and access permissions. When user-mode applications or kernel-mode malware attempt to access these pre-monitored buffers, the hypervisor can detect unauthorized accesses, buffer overflows, and code injection attempts before they execute malicious code. This preliminary monitoring approach enables early detection of malware activities that would otherwise be difficult to measure.
Data Source
AI summary
Technologies for securing an electronic device include determining addresses of one or more memory pages, injecting for each memory page a portion of identifier data into the memory page, storing an indication of the identifier data injected into each of the memory pages, determining an attempt to access at least one of the memory pages, determining any of the identifier data present on a memory page associated with the attempt, comparing the indication of the identifier data with the determined identifier data present on the memory page, and, based on the comparison, determining whether to allow the access.