Malware Detection via Memory and Thread Visibility Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection techniques struggle to accurately differentiate between malicious software and legitimate software due to similarities in their execution behaviors, leading to high false alarm or missed detection rates.
Innovation Solution
A malware detection system that monitors memory locations allocated by the operating system and thread initialization to identify suspicious activities, determining visibility characteristics that indicate evasion attempts, thereby distinguishing malicious software from legitimate software.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional malware detection techniques monitor software execution behaviors, then malware can be detected, but false alarm rates and missed detection rates increase due to similarities between malicious and legitimate software behaviors
Solution Approach 1:
The patent segments the malware detection process into multiple independent monitoring components: memory allocation monitoring, thread initialization monitoring, and visibility characteristic analysis. Each component focuses on a specific aspect of process behavior, allowing the system to accumulate evidence across multiple dimensions rather than relying on a single behavioral indicator, thereby improving differentiation precision while maintaining detection reliability
Solution Approach 2:
The patent introduces visibility characteristics as a new dimension for analysis, examining whether processes attempt to hide their execution through techniques like process injection or memory manipulation. This additional dimensional perspective allows the system to distinguish malicious software from legitimate software even when their basic execution behaviors overlap, resolving the contradiction between detection reliability and differentiation precision
2Measurement precision
If the system monitors multiple threads and memory locations to improve detection accuracy, then malware identification improves, but system complexity increases
Solution Approach 1:
The patent performs preliminary monitoring and analysis of process behaviors, maintaining records of memory allocations and thread initializations before making detection decisions. By preparing and analyzing multiple indicators in advance through structured data collection, the system achieves high identification precision without requiring complex real-time analysis, thus managing system complexity effectively
Solution Approach 2:
The patent introduces visibility characteristics as an intermediary layer between raw process behavior data and final malware classification. This intermediary analysis layer synthesizes information from multiple threads and memory locations into standardized indicators, simplifying the overall system architecture while maintaining high detection precision through systematic evidence aggregation
3Reliability
If the system analyzes visibility characteristics to detect evasion attempts, then malware detection reliability improves, but the time required for analysis increases
Solution Approach 1:
The patent implements a staged analysis approach where visibility characteristics are evaluated selectively based on initial monitoring results. Not all processes undergo complete visibility characteristic analysis—only those exhibiting suspicious patterns from preliminary monitoring. This partial action approach maintains high detection reliability for malicious software while reducing unnecessary analysis time for legitimate processes, effectively balancing reliability and time consumption
Data Source
AI summary
Some embodiments provide techniques for detecting presence of malicious software in a computing asset. The techniques identify, from among a plurality of memory locations allocated for use by a process managed by an operating system (OS) associated with the computing asset, memory location(s) to monitor in furtherance of detecting presence of malicious software in the computing asset, monitor threads initialized by the process using the identified memory location(s) to determine a number of threads so initialized, identify value(s) for visibility characteristic(s) of the process indicative of whether the process is attempting to evade detection of its execution on the computing asset, and determine whether the process is a malicious software process based on the number of threads and the value(s) for the visibility characteristic(s).