Malware Detection via Processor Trace and GPU Acceleration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection techniques face high performance and resource overhead due to indiscriminate scanning of large memory spaces, and fail to prioritize memory pages effectively, leading to inefficiencies in identifying and blocking malicious code, especially in packed malware applications.
Innovation Solution
The approach utilizes processor trace information to prioritize memory pages for scanning, detects invalid indirect branch instructions, and employs GPU acceleration and single table data structures for efficient pattern matching, reducing overhead and improving detection speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If indiscriminate scanning of large memory spaces is performed, then malware detection coverage is improved, but performance overhead and resource consumption increase
Solution Approach 1:
The patent segments the memory scanning task by dividing memory into pages and prioritizing them based on processor trace information. Instead of scanning all memory pages uniformly, the system identifies and scans only the most suspicious pages first, breaking down the large-scale scanning problem into manageable prioritized units.
Solution Approach 2:
The patent applies local quality by focusing scanning resources on specific memory pages that exhibit suspicious characteristics (invalid indirect branches) rather than applying uniform scanning across all memory. The scanning intensity and resource allocation vary locally based on the suspiciousness of each memory page.
2Reliability
If memory scanning is performed without prioritization, then detection thoroughness is maintained, but scan intervals increase and detection speed decreases
Solution Approach 1:
The patent performs preliminary analysis of memory pages using processor trace information to identify invalid indirect branches before conducting full malware pattern scanning. This preliminary action filters out suspicious pages that need immediate scanning, allowing the system to maintain thoroughness while reducing overall scan intervals by focusing on high-risk areas first.
Solution Approach 2:
The system uses processor trace information as feedback to dynamically prioritize memory pages for scanning. The trace information about indirect branches provides real-time feedback on which memory pages are suspicious, allowing the scanning system to adapt its priorities and reduce scan intervals for high-risk pages while maintaining overall detection thoroughness.
3Productivity
If GPU acceleration is implemented, then pattern matching speed is improved, but device complexity increases
Solution Approach 1:
The patent introduces GPU as an intermediary computing resource to handle the computationally intensive pattern matching task. The CPU prepares and prioritizes memory pages for scanning, then offloads the actual pattern matching to the GPU, which processes multiple patterns in parallel. This intermediary approach accelerates pattern matching while distributing system complexity across different components.
Data Source
AI summary
A system for detecting malware includes a processor to collect processor trace information corresponding to an application being executed by the processor (202). The processor can also detect an invalid indirect branch instruction from the processor trace information (204) and detect at least one malware instruction being executed by the application in response to analyzing modified memory values corresponding to the invalid indirect branch (206). Additionally, the processor can block the application from accessing or modifying memory (208).