Malware Detection via System Memory Structural Anomaly Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods that scan for byte sequences or signatures are ineffective against evolving malware techniques like process hollowing, DLL injection, and API hooking, as these methods fail to detect changes in executable regions of system memory.
Innovation Solution
The method involves obtaining structural information from a snapshot of system memory and comparing it with a process model of a clean version to identify anomalies, using by-name, by-hash, or by-content process models to determine if a process is infected with malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based malware scanning is used, then detection of known malware is improved, but detection of evolving malware techniques fails
Solution Approach 1:
The patent changes the detection parameter from static byte sequences (signatures) to dynamic structural characteristics of processes in system memory. By monitoring structural parameters such as process hierarchy, module loading patterns, and execution flow characteristics, the system can detect malware that modifies its signature while maintaining the same structural anomalies in system memory.
Solution Approach 2:
The patent transitions from static file-based scanning to dynamic process-based monitoring. By continuously observing the structural state of processes in system memory and comparing against baseline behavioral models, the system adapts to detect malware that dynamically changes its characteristics during execution, such as through process hollowing or DLL injection.
2Object-affected harmful factors
If process hollowing and DLL injection techniques are used by malware, then malware hiding capability is improved, but structural anomalies in system memory are created
Solution Approach 1:
The patent replaces traditional mechanical scanning methods with a model-based comparison approach. Instead of searching for malware signatures, the system builds baseline models of normal process structures and uses statistical or machine learning methods to detect deviations from these models, thereby identifying structural anomalies created by process hollowing or DLL injection without knowing the specific malware patterns.
3Adaptability or versatility
If structural information comparison with process models is performed, then detection of malware hiding techniques is improved, but system complexity increases
Solution Approach 1:
The patent creates simplified model representations (copies) of normal process structures that can be efficiently compared against actual process states. These process models capture essential structural characteristics without requiring complete analysis of every process detail, thereby reducing the computational complexity while maintaining effective detection capability.
Data Source
AI summary
Example implementations relate to determination as to whether a process is infected with malware. For example, in an implementation, information of a process extracted from a snapshot of system memory is obtained. A determination as to whether the process is infected with malware is made based on a process model.