Malware Process Detection via Post-Launch Memory Permission Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional Trojan Horse detection methods fail to identify injection-type malware processes that evade detection by modifying the memory permissions and writing malicious code, allowing them to go undetected even after launching trusted processes.
Innovation Solution
Monitoring the launch of processes and determining the memory block permissions post-launch, identifying potential malware by checking if the memory block allows write permissions, and verifying the PE header code to distinguish between ordinary and malicious processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional Trojan Horse detection methods use feature code matching with known malware processes, then detection accuracy for known malware is improved, but injection-type Trojan Horses that modify memory permissions and inject code into trusted processes can evade detection
Solution Approach 1:
The patent applies preliminary action by monitoring and recording the original memory permissions of processes before any potential injection occurs. The system captures the initial state of memory blocks associated with processes, creating a baseline that can be used to detect subsequent unauthorized modifications. This preliminary recording of memory permission states enables the system to identify injection-type Trojans that attempt to modify memory after process launch.
Solution Approach 2:
The patent implements feedback by continuously comparing current memory permissions against the originally recorded permissions. When a process modifies memory permissions after launch, the system detects this deviation from the original state and triggers further analysis. This feedback mechanism allows the system to adaptively respond to injection attempts by comparing the current state against the predetermined baseline state.
2Reliability
If the system monitors all process launches and checks memory permissions, then detection capability for injection-type malware is improved, but system performance and processing time increase
Solution Approach 1:
The patent applies local quality by focusing monitoring efforts specifically on memory permission changes rather than monitoring all process activities uniformly. Instead of examining every aspect of process behavior, the system concentrates on the specific property (memory permissions) that injection-type Trojans modify. This selective monitoring approach reduces overall processing requirements while maintaining high detection reliability for the target threat type.
Solution Approach 2:
The patent utilizes parameter changes by monitoring specific state changes in memory permissions rather than continuously analyzing all process parameters. The system detects anomalies by identifying changes in the permission state of memory blocks, which is a discrete and efficient parameter to monitor. This approach transforms the monitoring task from analyzing continuous process behavior to detecting specific state transitions, reducing computational overhead.
3Measurement precision
If the system checks memory permission modifications after process launch, then ability to detect injected code is improved, but false positives from legitimate processes with write permissions may increase
Solution Approach 1:
The patent applies preliminary action by recording the original memory permissions of processes before they are launched or before any code injection attempt occurs. This predetermined baseline of what constitutes normal, authorized memory access patterns is established in advance, allowing the system to distinguish between legitimate write operations and malicious injections based on comparison with the original authorized state.
Solution Approach 2:
The patent implements feedback by comparing current memory permission states against the originally recorded authorized states. When a permission change is detected, the system provides feedback by analyzing whether the change aligns with the process's authorized operations or represents an unauthorized injection. This feedback loop enables the system to reduce false positives by contextualizing permission changes against predetermined authorization baselines.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Detecting a malware process is disclosed, including: monitoring a launch of a process; in response to a completion of the launch of the process, determining a base address associated with the process; determining a permission of a memory block associated with the base address; and determining whether the process is potentially associated with a malware process based at least in part on the determined permission.