Hypervisor Page Table Executability for Zero-Day Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems are ineffective in detecting zero-day attacks, as they rely on pre-existing malware fingerprints that are unavailable for unknown security vulnerabilities, making it difficult to identify and prevent such attacks.
Innovation Solution
A computer-implemented method and system for recording forensic data using hypervisor-based continuous monitoring of virtualized operating systems, which generates fingerprint data indicative of unauthorized activities without relying on pre-existing fingerprints, by setting executability states of page table entries and storing target addresses in breakpoint registers to record forensic data during unauthorized activity attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If malware fingerprints are used for intrusion detection, then detection accuracy for known threats is improved, but detection capability for zero-day attacks deteriorates
Solution Approach 1:
The system performs preliminary actions by setting breakpoint registers and configuring page table executability states before unauthorized activities occur. This allows the system to proactively capture forensic data when suspicious activities attempt to execute, enabling detection of zero-day attacks without relying on pre-existing malware fingerprints.
Solution Approach 2:
The patent introduces an intermediary mechanism using page table executability states as a mediator between the security monitoring system and the actual code execution. By controlling which pages are executable through page table entries, the system can intercept and record forensic data about unauthorized activities before they fully execute, bridging the gap between detection and prevention.
2Reliability
If continuous monitoring of all code execution is implemented, then detection of unauthorized activities is improved, but system performance deteriorates
Solution Approach 1:
The system applies local quality by selectively monitoring only specific code pages that are marked as non-executable in the page table. Instead of continuously monitoring all code execution, the system focuses resources on pages that have been pre-identified as potential unauthorized activities, achieving reliable detection while minimizing performance impact.
Solution Approach 2:
The patent implements partial action by using breakpoint registers to monitor only a subset of critical target addresses rather than all possible execution points. The system sets breakpoints at strategically important locations identified through the list of target addresses, providing sufficient detection capability without the overhead of comprehensive monitoring.
3Loss of information
If breakpoint registers are used to store target addresses, then forensic data collection is improved, but the number of monitorable addresses is limited
Solution Approach 1:
The system transitions to another dimension by using page table executability states as an additional layer of control beyond traditional breakpoint registers. Instead of relying solely on the limited capacity of breakpoint registers, the system leverages the page table structure to manage a much larger number of monitorable addresses through executable and non-executable page markings.
Solution Approach 2:
The patent applies segmentation by dividing the monitoring function into two complementary components: breakpoint registers for immediate interception and page table executability states for broader control. This segmentation allows the system to manage multiple target addresses efficiently by distributing monitoring responsibilities across different memory management structures.
Data Source
AI summary
A method includes receiving a list of target addresses, locating a first page table entry corresponding to the first page, and determining the first executability state. When the first executability state is non-executable, a first set of one or more target addresses that correspond to the first page, and a second set of one or more target addresses that correspond to one or more pages other than the first page are identified. One or more target addresses are stored in breakpoint registers of the computer system. The first executability state of the first page table entry is set as executable, and the executability states of page table entries that correspond to the second set of target addresses are set as non-executable. When the first address matches one of the target addresses stored in the breakpoint registers, forensic data is recorded.