Memory Access Control for Exploit Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies are inadequate in effectively preventing and detecting the latest variants of exploits, as they can be bypassed by sophisticated malware that disguises harmful behavior through benign operations, and do not address the diversity of operations used by exploits to introduce malicious code.
Innovation Solution
A memory access control arrangement is implemented where write and execute privileges are enforced for allocated memory portions, with an interceptor module recording associations and adjusting access controls to monitor exceptions, determining exception types, and initiating malware analysis to prevent malicious code execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If memory access control is enforced with write and execute privileges, then protection against exploits is improved, but system complexity increases due to monitoring and exception handling
Solution Approach 1:
The patent segments memory into multiple regions with different access control characteristics. Each memory region can have independent write and execute permission settings, allowing fine-grained control over where code can be written and executed. This segmentation enables the system to enforce security policies without requiring complex global monitoring of all memory operations.
Solution Approach 2:
The patent introduces an intermediary component (exception handling mechanism) that mediates between the memory access control regime and the exploit detection/analysis functions. When write or execute exceptions occur, the intermediary captures these exceptions and routes them to appropriate analysis routines, simplifying the overall system architecture by providing a standardized interface for exception processing.
2Measurement precision
If monitoring of memory access exceptions is implemented, then detection of malicious code is improved, but processing time increases due to exception analysis
Solution Approach 1:
The patent performs preliminary actions by pre-configuring memory regions with appropriate write and execute permissions before code execution. By establishing the access control regime in advance, the system can quickly detect violations without requiring complex real-time analysis of each memory access operation. The exception types are pre-defined and categorized, enabling rapid routing to appropriate handling routines.
Solution Approach 2:
The patent applies different analysis strategies to different types of exceptions based on their local characteristics. Write exceptions to non-writable regions are handled differently from execute exceptions to non-executable regions. Each exception type can be routed to specialized analysis routines that are optimized for detecting specific exploit techniques, improving detection efficiency while minimizing processing time.
3Reliability
If limited access regime is enforced on memory portions, then prevention of malicious code execution is improved, but adaptability decreases for legitimate code that requires dynamic memory access
Solution Approach 1:
The patent implements a dynamic memory access control system where write and execute permissions can be adjusted based on the execution context. Legitimate code that requires dynamic memory access patterns can have its permissions temporarily modified through controlled mechanisms, while malicious code attempting unauthorized access patterns is blocked. The system adapts permission settings dynamically rather than using static, rigid access control.
Solution Approach 2:
The patent creates a universal memory access control framework that serves multiple functions: protecting against exploits, enabling legitimate dynamic memory operations, and providing a basis for code analysis. The same memory access control infrastructure supports both security enforcement and legitimate program execution by interpreting access patterns in context and allowing appropriate operations while blocking malicious ones.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Protection of a computer system against exploits. A computer system has a memory access control arrangement in which at least write and execute privileges are enforced for allocated portions of memory. An association of the process thread and the first portion of memory is recorded. A limited access regime in which one of the write and execute privileges is disabled, is established, and is monitored for any exceptions occurring due to attempted writing or execution in violation thereof. In response to the exception being determined as a write exception, the associated process thread is looked up, and analyzed for a presence of malicious code. In response to the exception type being determined as an execute exception, the first portion of memory is analyzed for a presence of malicious code. In response to detection of a presence of malicious code, execution of the malicious code is prevented.