In-Memory Scanning for Fileless Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware prevention systems are ineffective against fileless malware, which evades detection by residing in endpoint memory without leaving traces in the filesystem, as they are configured to scan files rather than memory.
Innovation Solution
A computerized method and system where an anti-malware scanner on a host device processes malware scan requests from virtual computing instances by scanning script data directly from memory buffers, preventing the execution of malware by notifying the virtual computing instances if malware is detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware prevention systems scan files in the filesystem, then they can detect traditional malware, but they cannot detect fileless malware that resides only in memory
Solution Approach 1:
The patent transitions the detection scope from the traditional filesystem dimension to the memory dimension. The AMSI provider intercepts script execution in memory by receiving script data from the VCI's memory buffer, scanning it for malware, and returning results. This dimensional shift from file-based to memory-based detection enables the system to detect fileless malware while maintaining compatibility with traditional file-based detection mechanisms.
2Reliability
If malware prevention systems scan memory directly, then they can detect fileless malware, but it increases complexity of the scanning system
Solution Approach 1:
The AMSI provider is designed with multi-functionality to handle both traditional file-based malware scanning and memory-based fileless malware scanning through a unified interface. The same scanning mechanism processes script data regardless of its source, whether from filesystem or memory buffer. This universal approach reduces system complexity by avoiding separate scanning pathways while maintaining comprehensive detection capabilities.
3Productivity
If multiple virtual computing instances execute scripts, then computational productivity increases, but the risk of malware execution increases
Solution Approach 1:
The system performs preliminary malware scanning of script data before allowing execution in any VCI. The AMSI provider intercepts script data from the VCI's memory buffer, scans it for malware content, and only allows execution if the scan is clean. This preliminary security check is performed once per script, enabling multiple VCIs to safely execute the same validated script without repeating full security checks, thus maintaining productivity while reducing malware risk.
Data Source
AI summary
The disclosure herein describes the processing of malware scan requests from VCIs by an anti-malware scanner (AMS) on a host device. A malware scan request is received by the AMS from a VCI, the malware scan request including script data of a script from a memory buffer of the VCI. The AMS scans the script data of the malware scan request, outside of the VCI, and determines that the script includes malware. The AMS notifies the VCI that the script includes malware, whereby the VCI is configured to prevent execution of the script or take other mitigating action. The AMS provides scanning for fileless malware to VCIs on a host device without consuming or otherwise affecting resources of the VCIs.