Malware Detection via Thread Return Address Inspection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods, particularly signature-based detection, are ineffective against zero-day attacks and sophisticated malware that injects code into system processes, as they require prior knowledge of the malware specifics and cannot detect suspicious code running within system processes without detailed code analysis.
Innovation Solution
A method that identifies suspicious code injected into system processes by inspecting threads for potential return addresses within suspicious memory areas, using APIs like Module32First, Module32Next, and VirtualQueryEx to differentiate between legitimate and suspicious memory areas, and determining if the instruction preceding the return address is a function call to flag the code as suspicious.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection methods are used to detect malware, then detection accuracy for known malware is improved, but effectiveness against zero-day attacks and sophisticated injected code deteriorates
Solution Approach 1:
The patent segments the detection process into two independent modules: a signature-based detection module for known malware and a heuristic analysis module for suspicious behavior detection. This segmentation allows each module to specialize in its strength while working together to provide comprehensive protection, resolving the contradiction between detection accuracy for known malware and adaptability to zero-day attacks.
Solution Approach 2:
The patent merges signature-based detection with heuristic analysis into a unified detection system. The heuristic module analyzes code behavior, memory access patterns, and execution flow to detect suspicious activities, while the signature module provides precise identification of known threats. This combination maintains high detection accuracy for known malware while adding adaptability to detect unknown and zero-day threats through behavioral analysis.
2Measurement precision
If code analysis with signatures is used to detect malware, then identification of known malware is improved, but detection of obfuscated code and zero-day attacks deteriorates
Solution Approach 1:
The patent introduces heuristic analysis as an intermediary layer between the user and the malware. Instead of directly comparing code against signatures (which fails against obfuscation), the heuristic module first analyzes behavioral patterns, memory access characteristics, and execution flow to identify suspicious code. This intermediary approach enables detection of obfuscated and zero-day malware by focusing on behavior rather than static code characteristics.
3Adaptability or versatility
If heuristic methods are used to detect suspicious behavior, then protection against zero-day attacks is improved, but false positive rate increases
Solution Approach 1:
The patent implements feedback mechanisms where detection results from both signature-based and heuristic modules are cross-validated. When heuristic analysis flags suspicious code, the system checks against the signature database to confirm or refute the finding. This feedback loop reduces false positives by requiring corroboration from multiple detection approaches while maintaining high adaptability to zero-day threats through the heuristic component.
Data Source
AI summary
A method of detecting suspicious code that has been injected into a process. The method includes identifying suspicious executable memory areas assigned to the process and, for each thread in the process, inspecting a stack associated with the thread to identify a potential return address; determining whether or not the potential return address is located within a suspicious memory area; and, if the potential return address is located within a suspicious memory area, determining whether or not the instruction at the address preceding the potential return address is a function call and, if yes, determining that the potential return address is a true return address and identifying the thread and associated code as suspicious.