Malicious Code Detection Module Examining Call Stacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing solutions are inadequate for detecting malicious instructions injected into the memory of computing devices, as they primarily focus on scanning non-volatile storage and lack effective methods for identifying threats in volatile memory.
Innovation Solution
A malicious code detection module that examines the call stack of each thread to identify originating modules not backed by a disk image, flags potentially malicious threads, and generates an alert or suspends their execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If prior art scanning techniques are used to detect malicious code, then known malicious programs stored in non-volatile storage can be identified, but malicious instructions injected into volatile memory cannot be detected
Solution Approach 1:
The patent transitions from scanning only non-volatile storage (one dimension) to examining both non-volatile storage and volatile memory call stacks (additional dimension). This dimensional expansion allows detection of injected malicious instructions in memory that traditional disk-based scanners cannot detect, directly resolving the contradiction between reliable detection of stored malware and adaptable detection of in-memory threats
2Adaptability or versatility
If comprehensive memory scanning is implemented to detect injected malicious instructions, then detection scope is improved, but system performance and complexity increase
Solution Approach 1:
The patent extracts only the critical information needed for detection (call stack data from volatile memory) without implementing comprehensive scanning of all memory contents. By taking out only the essential call stack information and examining it for suspicious patterns, the system achieves expanded detection scope while avoiding the complexity and performance overhead of exhaustive memory scanning
3Measurement precision
If existing virus scan software is used, then scanning of non-volatile storage is effective, but detection of in-memory malicious code is insufficient
Solution Approach 1:
The patent creates a multi-functional detection system that performs both traditional virus scanning of non-volatile storage and examination of volatile memory call stacks. This universal approach allows the same detection mechanism to handle both stored malware and injected in-memory threats, simultaneously improving detection accuracy for known viruses and expanding coverage to include previously undetectable in-memory attacks
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In the embodiments described herein, a malicious code detection module identifies potentially malicious instructions in memory of a computing device. The malicious code detection module examines the call stack for each thread running within the operating system of the computing device. Within each call stack, the malicious code detection module identifies the originating module for each stack frame and determines whether the originating module is backed by an image on disk. If an originating module is not backed by an image on disk, the thread containing that originating module is flagged as potentially malicious, execution of the thread optionally is suspended, and an alert is generated for the user or administrator.