Hypervisor Memory Tagging for Context-Aware Integrity Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Sophisticated malware detection in computer systems is challenging due to the need for monitoring system memory outside the main CPU, and existing methods lack effective mechanisms for identifying and addressing integrity issues in critical memory pages.
Innovation Solution
A computer-implemented method using a hypervisor to determine the type of operating system loaded in system memory, examine system memory pages, assign tags based on OS type, hash contents for integrity checks, and compare hash values to golden hash values to ensure integrity, with features like context-aware monitoring and hot patching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If system memory monitoring is performed outside the main CPU using a hypervisor, then malware detection capability is improved, but system complexity and monitoring overhead increase
Solution Approach 1:
The patent segments system memory into individually tagged pages, allowing selective monitoring of only critical memory regions rather than entire system memory. This reduces monitoring overhead and complexity while maintaining detection capability for malicious modifications in critical areas.
Solution Approach 2:
The patent applies different monitoring strategies to different memory pages based on their criticality tags. Critical pages receive intensive monitoring with hashing and verification, while non-critical pages use standard monitoring, optimizing resource allocation and reducing overall system complexity.
2Measurement precision
If all system memory pages are monitored for integrity, then detection precision is improved, but processing time and computational resources increase
Solution Approach 1:
The patent divides system memory into critical and non-critical pages using tags, enabling selective integrity verification only on critical pages. This segmentation maintains high detection precision for malicious modifications while reducing processing time by excluding non-critical memory regions from intensive monitoring.
Solution Approach 2:
The patent applies partial action by performing full integrity verification (hashing and comparison) only on critical memory pages rather than all pages. This provides sufficient detection precision for security-critical areas while minimizing computational overhead and processing time.
3Adaptability or versatility
If context-aware tagging is implemented for system memory pages, then adaptability of monitoring is improved, but device complexity increases
Solution Approach 1:
The patent performs preliminary action by determining OS type and assigning criticality tags to memory pages during system initialization and OS loading phases. This advance tagging enables adaptive monitoring without adding runtime complexity, as the tagging structure is established before monitoring begins.
Solution Approach 2:
The patent introduces tags as intermediary markers on memory pages that encode criticality information. These tags serve as a simple interface between the hypervisor and memory management system, enabling context-aware monitoring adaptability without direct complex interactions between monitoring components.
Data Source
AI summary
Techniques are disclosed for context-aware monitoring of the system memory to provide system integrity. An example methodology implementing the techniques includes determining a type of operating system (OS) that is loaded on system memory, examining contents of at least one system memory page, and assigning at least one tag to the at least one system memory page based on the determined type of OS and the examination of the contents of the at least one system memory page. The at least one tag indicates the characteristics of the contents of the at least one system memory page.