Kernel Memory Malware Detection via Type Graph Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems fail to effectively detect and prevent kernel-mode malware attacks, particularly those that manipulate function pointers and dynamic kernel data, leading to incomplete security coverage and missed vulnerabilities.
Innovation Solution
A method involving static analysis to construct an extended type graph of the operating system kernel, combined with runtime memory snapshot analysis to identify and validate function pointers, ensuring comprehensive kernel integrity checking and detection of compromised memory areas.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If anti-virus systems use known malware descriptions for detection, then detection accuracy for known threats is improved, but detection capability for zero-day vulnerabilities and unknown malware deteriorates
Solution Approach 1:
The system performs preliminary actions by constructing an extended type graph from static code analysis before runtime execution. This pre-computed type information is stored and reused during runtime memory analysis, enabling rapid detection of both known and unknown malware without requiring real-time compilation or extensive scanning.
Solution Approach 2:
The patent introduces an extended type graph as an intermediary data structure that bridges static code analysis and runtime memory inspection. This type graph serves as a mediator that translates static type information into runtime validation rules, enabling the system to detect malware by comparing actual memory structures against expected type definitions without directly executing or scanning the malware itself.
2Reliability
If intrusion detection systems implement multiple heuristics for malware identification, then detection coverage is improved, but false positive rate and system complexity increase
Solution Approach 1:
The system changes parameters by transitioning from heuristic-based detection to type-based validation. Instead of using multiple complex heuristics that analyze behavioral patterns, the system validates memory structures against predefined type definitions from the extended type graph. This parameter change simplifies the detection logic while maintaining high detection coverage through systematic type checking.
Solution Approach 2:
The patent replaces the mechanical heuristic-based detection system with a type-based validation mechanism. Rather than manually crafted heuristics that require expert knowledge and continuous tuning, the system automatically validates memory structures against type definitions derived from static code analysis, substituting complex mechanical detection rules with systematic type checking.
3Measurement precision
If KOMOKO system uses manually derived conditions for Windows configuration validation, then detection of configuration-based malware is improved, but detection of malware that violates no pre-generated conditions deteriorates
Solution Approach 1:
The extended type graph serves multiple functions: it provides type definitions for validation, guides memory search patterns, and enables detection of both configuration-based and structure-based malware. This universal type-based approach replaces the single-purpose heuristic conditions with a multi-functional framework that adapts to various malware techniques through systematic type checking.
Solution Approach 2:
The system introduces dynamics by generating type definitions dynamically from static code analysis rather than using fixed manual conditions. The extended type graph is constructed automatically from the software environment's code, allowing the detection system to adapt to different software configurations and versions without requiring manual updates to detection rules.
4Measurement precision
If static analysis is performed on kernel code to construct type graphs, then detection accuracy for kernel-mode malware is improved, but analysis time and computational resources increase
Solution Approach 1:
The system performs static code analysis and type graph construction as a preliminary action during system initialization or offline processing. This pre-computed type information is cached and reused during runtime malware detection, eliminating the need to perform expensive static analysis repeatedly and significantly reducing real-time detection overhead.
Solution Approach 2:
The patent extracts type information from kernel code through static analysis and separates it from runtime detection operations. By extracting type definitions into a standalone extended type graph, the system enables fast runtime validation without requiring access to or re-analysis of the original kernel code, significantly reducing computational overhead during detection.
Data Source
AI summary
Technology is described for malware investigation by analyzing computer memory in a computing device. The method can include performing static analysis on code for a software environment to form an extended type graph. A raw memory snapshot of the computer memory can be obtained at runtime. The raw memory snapshot may include the software environment executing on the computing device. Dynamic data structures can be found in the raw memory snapshot using the extended type graph to form an object graph. An authorized memory area can be defined having executable code, static data structures, and dynamic data structures. Implicit and explicit function pointers can be identified. The function pointers can be checked to validate that the function pointers reference a valid memory location in the authorized memory area and whether the computer memory is uncompromised.