Kernel Memory Atomic Detection and Repair via Single-Core Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer malware operating in multi-core or multi-processor environments is difficult to detect and remove due to its ability to make malicious modifications to kernel memory, often running at a low system level and interfering with atomic operations.
Innovation Solution
A method involving an anti-malware application that allocates a contiguous block of memory, disables all but one processing entity, scans for memory modifications, and repairs detected changes, allowing the remaining entity to execute instructions for detection and repair without interruption.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If malware operates in multi-core environment with concurrent processing, then system productivity is improved, but detection reliability deteriorates due to interference with atomic operations
Solution Approach 1:
The patent segments the multi-core processing environment by isolating the detection operation to a single processing entity. By disabling all but one processing entity during the scanning operation, the system creates a segmented temporal execution model where detection occurs in isolation, preventing malware from interfering with atomic operations while maintaining multi-core productivity during non-detection phases
Solution Approach 2:
The patent applies preliminary action by disabling other processing entities before the detection operation begins. This pre-established isolated environment ensures that when the scanning instruction executes, no other processing can interfere with the atomic operation, thereby guaranteeing detection reliability without permanently sacrificing system productivity
2Productivity
If all processing entities remain enabled during scanning, then system productivity is maintained, but measurement precision deteriorates due to potential memory modifications by malware
Solution Approach 1:
The patent segments the processing entities temporally during the scanning operation. By activating only one processing entity at a time for detection purposes, the system creates a controlled environment where memory state can be accurately measured without concurrent modifications, thereby improving measurement precision while minimizing productivity impact through sequential rather than simultaneous operation
Solution Approach 2:
The patent creates an inert processing environment by disabling all but one processing entity during the memory scan. This inert state prevents malware from actively modifying memory during detection, ensuring measurement precision. The system temporarily enters this low-activity state only when detection is required, then restores full processing capability afterward
Data Source
AI summary
A method for detecting memory modifications includes allocating a contiguous block of a memory of an electronic device, and loading instructions for detecting memory modifications into the contiguous block of memory. The electronic device includes a plurality of processing entities. The method also includes disabling all but one of a plurality of processing entities of the electronic device, scanning the memory of the electronic device for modifications performed by malware, and, if a memory modification is detected, repairing the memory modification. The method also includes enabling the processing entities that were disabled. The remaining processing entity executes the instructions for detecting memory modifications.