Malicious Thread Detection via Memory Heap Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware protection software struggles to effectively identify and terminate malicious threads within legitimate computer processes, as some malware can re-infect systems while executing as threads, and existing methods may produce false positives or affect legitimate processes.
Innovation Solution
The method involves identifying memory heap blocks, determining the presence of malicious threads by comparing signatures, and terminating all threads within identified malicious memory segments to prevent further malware activity without impacting legitimate processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware protection software scans computer memory and disk drives for malicious code by comparing signatures, then known malware can be identified and removed, but some malware capable of re-infection can evade detection and continue executing as threads within legitimate processes
Solution Approach 1:
The patent segments the detection approach by focusing specifically on memory heap blocks and threads rather than scanning all computer memory and disk drives. This segmentation allows the system to target malicious threads executing within legitimate processes more effectively, improving reliability against re-infection while reducing the overall complexity of the detection system by concentrating resources on high-risk areas.
2Reliability
If malware protection software terminates identified malicious threads, then malware execution is stopped and re-infection is prevented, but false positives may occur affecting legitimate computer processes
Solution Approach 1:
The patent introduces memory heap block analysis as an intermediary step between thread identification and termination. By first analyzing the memory heap block to determine if it contains malicious code before terminating threads, the system creates a buffer that reduces false positives. This intermediary verification mechanism ensures that only threads associated with confirmed malicious memory blocks are terminated, protecting legitimate processes from erroneous termination.
3Reliability
If malware protection software scans all computer memory for malicious code, then comprehensive malware detection is achieved, but scanning speed and system performance are reduced
Solution Approach 1:
The patent extracts and focuses the scanning effort on specific high-value targets: memory heap blocks and threads, rather than scanning all computer memory. This extraction of the essential detection target from the broader memory space allows the system to maintain comprehensive detection of malicious threads while significantly improving scanning speed and system performance by avoiding unnecessary scanning of clean memory areas.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for identifying and processing malicious threads In one aspect, a method includes identifying a memory heap block; identifying threads that reside in the memory heap block; determining whether at least one of the identified threads in the memory heap block is a malicious thread; and in response to determining that at least one of the identified threads is a malicious thread, terminating each of the identified threads.