Malicious Code Detection in Trusted Process Address Space
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus systems fail to detect malicious code embedded in the address space of trusted processes, as they do not perform analysis on code within this space, leading to undetected and unblocked malicious actions.
Innovation Solution
A system and method that detect the launching of trusted processes, identify suspicious memory areas outside the trusted executable image, analyze nearby memory areas for executable images, and determine if they contain malicious code, allowing for removal, halting, or quarantining of such code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If antivirus applications perform comprehensive analysis of all code in process address space using signature analysis, heuristic analysis, and behavioral analysis, then detection precision of malicious code is improved, but computing resource consumption increases significantly
Solution Approach 1:
The patent applies local quality by differentiating analysis depth based on memory region characteristics. Trusted process address spaces use white list verification for routine operations, while suspicious memory regions (identified by unusual patterns, untrusted sources, or anomalous behavior) trigger comprehensive analysis including signature analysis, heuristic analysis, and behavioral analysis. This localized approach ensures high detection precision for malicious code while avoiding unnecessary computing resource consumption in safe regions.
Solution Approach 2:
The patent segments the process address space into multiple regions with different trust levels and analysis requirements. Memory is divided into trusted regions (verified through white lists), suspicious regions (requiring monitoring), and untrusted regions (subject to strict analysis). This segmentation allows the system to apply appropriate detection methods to each region, improving overall detection precision while optimizing computing resource allocation by focusing intensive analysis only where needed.
2Use of energy by moving object
If antivirus applications do not perform analysis on code within the address space of trusted processes, then computing resource consumption is reduced, but malicious code embedded in trusted processes remains undetected
Solution Approach 1:
The patent implements preliminary action by establishing white lists of trusted processes and their authorized code segments before execution. These pre-verified trusted processes receive expedited processing with reduced scanning, lowering computing resource consumption. Meanwhile, the system continuously monitors for deviations from trusted behavior patterns and suspicious memory access, enabling early detection of malicious code injection into trusted processes without requiring comprehensive continuous analysis of all trusted code.
Solution Approach 2:
The patent employs feedback mechanisms where the system continuously monitors the behavior of trusted processes and adjusts analysis intensity based on observed anomalies. When a trusted process exhibits suspicious behavior patterns (such as accessing unusual memory regions, unexpected system calls, or abnormal execution flows), the system dynamically increases detection intensity for that process. This feedback-driven approach maintains detection reliability by responding to actual threats while preserving computing resources during normal operation of trusted processes.
Data Source
AI summary
Disclosed are methods and systems for detecting malicious codes in the address space of processes. The described method detects a launching of a process from an executable file executing on a computer, detects access to a address within a memory area in an address space of the trusted process, wherein the memory area is a memory area that lies outside the boundaries of the trusted executable image representing the executable file and is an executable memory area, analyzes memory areas within a vicinity of the address space to determine whether another executable image is located in the memory areas, analyzing the another executable image to determine whether the other executable image contains malicious code, concluding malicious code is contained in the address space of the trusted process when the another executable image contains malicious code and performing one of removing, halting or quaranting the malicious code from the address space.