Malware Detection via Memory Allocation Pattern Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection methods struggle to identify malicious programs that overwrite or wipe memory signatures, making it difficult to detect threats as the metadata associated with memory allocations cannot be erased, leading to challenges in identifying patterns of memory allocations.
Innovation Solution
A method for threat detection that involves identifying patterns of memory allocations by tracking and comparing sequences of memory allocations to known malware threats, determining matches based on a confidence threshold, and performing security actions when the threshold is satisfied, such as flagging or quarantining potential malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If malware overwrites or wipes memory signatures to hide malicious content, then the detectability of malware is reduced, but the ability to trace memory allocation patterns is compromised
Solution Approach 1:
The system performs preliminary tracking and recording of memory allocation patterns before malware has an opportunity to wipe or overwrite memory signatures. By capturing the sequence, size, and timing of memory allocations in advance, the system preserves critical forensic information that would otherwise be lost when malware attempts to conceal its presence.
Solution Approach 2:
The system introduces an intermediary layer (the memory allocation tracking mechanism) that sits between the malware and the detection system. This intermediary continuously monitors and logs memory allocation events, creating a persistent record that survives even when malware wipes its own memory signatures, thereby bridging the gap between malware activity and detectable evidence.
2Measurement precision
If traditional malware detection methods rely on content analysis, then detection accuracy is high for unmodified malware, but effectiveness drops when malware wipes its signatures
Solution Approach 1:
The system extracts the detection problem from reliance on malware content signatures and separates it into a different observable dimension: memory allocation behavior. By taking out the dependency on persistent content signatures and focusing instead on the transient but recordable memory allocation patterns, the system maintains detection accuracy even when malware content is wiped or modified.
Solution Approach 2:
The system changes the detection parameter from content-based signatures to behavioral parameters (memory allocation size, sequence, frequency, and timing). This parameter transformation allows detection to remain reliable against wiped malware because behavioral patterns persist in the allocation records even when the actual malicious content is destroyed or obscured.
3Difficulty of detecting and measuring
If the system tracks all memory allocations to identify malware patterns, then detection capability is improved, but system performance overhead increases
Solution Approach 1:
The system applies partial tracking by focusing only on the specific memory allocation attributes necessary for malware detection (sequence, size, timing) rather than monitoring every detail of memory operations. This selective partial action provides sufficient detection capability while minimizing the performance overhead associated with comprehensive memory monitoring.
Data Source
AI summary
A method for threat detection by identifying patterns of used memory blocks is described. In one embodiment, the method includes identifying a pattern of memory allocations from a known malware threat; tracking memory allocations of memory; identifying a plurality of memory allocations that match at least a portion of the pattern of memory allocations based at least in part on the tracking of the memory allocations; and performing a security action upon determining a quantity of the plurality of memory allocations satisfies a predetermined threshold. In some examples, the method includes determining that a sequence of wiped data strings satisfies a confidence threshold, and identifying the plurality of memory allocations is based at least in part on the confidence threshold. In some cases, the security action includes flagging the identified pattern of memory allocations, quarantining an associated application or process, or generating a notification.