Malicious Code Prevention Module for Volatile Memory
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies lack effective mechanisms for detecting and preventing the execution of malicious instructions in memory and threads within computing devices, particularly for unknown or newly introduced malware, and fail to address threats in volatile memory and processor environments.
Innovation Solution
A malicious code prevention module identifies and replaces potentially malicious instructions in volatile memory with innocuous ones and terminates potentially malicious threads by modifying their initial instructions, utilizing attribute information to differentiate between file-backed and non-file-backed executable entities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If prior art scanning modules scan non-volatile storage for malicious code, then known malicious programs can be identified and nullified, but malicious instructions in volatile memory and processor cannot be detected
Solution Approach 1:
The patent extends the detection scope from non-volatile storage (traditional dimension) to volatile memory and processor instructions (new dimensions). The scanning module now operates across multiple memory hierarchies including RAM, cache memory, and processor instruction streams, enabling detection in previously inaccessible dimensions where malware can execute without being stored on disk.
Solution Approach 2:
The system performs preliminary scanning of instructions in volatile memory and processor before they are executed. By intercepting and scanning instructions at the memory and processor level prior to execution, the system can identify and neutralize malicious code even before it activates, preventing harm rather than responding after detection.
2Reliability
If virus scan software scans storage devices for malicious code, then known viruses can be detected, but unknown or newly introduced malware cannot be detected
Solution Approach 1:
The patent changes the detection parameters from signature-based matching (which only detects known viruses) to behavioral and structural analysis of instructions. The scanning module examines instruction characteristics, execution patterns, and memory access behaviors to identify malicious code regardless of whether it is in the virus database, enabling detection of unknown and newly introduced malware.
Solution Approach 2:
The system replaces the mechanical approach of comparing against stored virus signatures with a more sophisticated analysis mechanism that evaluates instruction behavior and characteristics in real-time. This substitution enables detection of novel malware that has not been previously cataloged, as the system analyzes actual execution patterns rather than relying on pre-existing signature databases.
3Reliability
If the system scans and analyzes all instructions in memory and processor, then malicious instructions can be detected, but system performance and execution speed are reduced
Solution Approach 1:
The patent implements partial scanning where the module selectively scans instructions based on risk assessment rather than scanning every instruction uniformly. High-risk instructions, memory regions, or code segments showing suspicious patterns are scanned in detail, while low-risk areas receive minimal or no scanning, maintaining security effectiveness while reducing overall performance impact.
Solution Approach 2:
The system skips over instructions that are determined to be safe or low-risk during the scanning process, rushing through verified benign code without detailed analysis. This selective skipping allows the scanning module to focus computational resources on potentially malicious instructions while maintaining fast execution for known-safe code paths.
Data Source
AI summary
In one embodiment, a malicious code prevention module identifies potentially malicious instructions in volatile memory of a computing device and replaces them with innocuous instructions. In another embodiment, the malicious code prevention module identifies a potentially malicious thread within an operating system and replaces the first instruction in the thread with a new instruction that terminates the thread. Malicious code prevention module prevents malicious code from inflicting any harm on the computing device and its contents.