Discrete Stateful Malware Detection via Memory Forensics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional anti-virus and anti-malware solutions are reactive and struggle to cope with sophisticated malware attacks, often causing system stability and performance issues due to complex behavioral analysis requirements and constant monitoring needs.
Innovation Solution
A method for discrete stateful behavioral analysis that scans computing system resources at two distinct times to identify malware changes and their relationships with system executable objects, using anti-virus and memory forensics modules to create behavioral digests and apply rules to detect malware without continuous monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If constant monitoring of system events is implemented to achieve proactive malware detection, then malware detection capability is improved, but system complexity and stability issues worsen due to the need for inserting sensors into operating system and application memory
Solution Approach 1:
The patent extracts the malware detection function from the operating system kernel by using a host-based intrusion detection system that operates at the user level. Instead of inserting sensors into the operating system memory, the system creates a virtual copy of the operating system memory space and performs analysis outside the critical system kernel, thereby maintaining detection capability while reducing system complexity and stability risks
Solution Approach 2:
The patent introduces a memory forensics module as an intermediary between the operating system and the analysis engine. This module creates a virtual copy of the operating system memory space, allowing malware behavior analysis without direct interference with the actual system memory, thus resolving the contradiction between detection capability and system stability
2Speed
If sensors are inserted into operating system and application memory for constant monitoring, then real-time malware detection is improved, but system stability worsens due to potential conflicts and performance issues
Solution Approach 1:
The patent segments the memory analysis function into separate, isolated components. Instead of a monolithic sensor insertion approach, the system divides memory space into virtual copies that can be analyzed independently. This segmentation allows real-time detection while preventing stability issues from propagating to the actual system
Solution Approach 2:
The patent creates virtual copies of operating system memory space rather than directly monitoring the actual system memory. These copies serve as safe analysis environments where sensors and monitoring mechanisms can operate without risking system stability, while still providing real-time detection capabilities through continuous copying and analysis
3Reliability
If complex behavioral analysis solutions are implemented for proactive protection, then malware detection effectiveness is improved, but development time and resource requirements worsen
Solution Approach 1:
The patent implements a universal memory forensics framework that can analyze multiple types of malware behaviors through a single integrated system. The behavioral analysis engine processes various malware techniques (persistence mechanisms, privilege escalation, lateral movement) using common memory analysis functions, reducing development time while maintaining detection effectiveness across diverse threat types
Data Source
AI summary
A method for analyzing a computing system includes the steps of at a first moment in time, scanning the resources of the computing system for indications of malware, at a second moment in time scanning the resources of the computing system for indications of malware and determining the system executable objects loaded on the computing system, determining malware system changes, identifying a relationship between the malware system changes and the system executable objects loaded on the computing system, and identifying as suspected malware the system executable objects loaded on the computing system which have a relationship with the malware system changes. The malware system changes include differences between the results of scanning the resources of the computing system for indications of malware at the second and first moment of time.