Memory-Based Program Verification for File-Less Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing techniques for preventing the execution of illegal programs, such as malware, are ineffective in verifying programs without a physical file form, particularly those executed in memory, as they rely on file system verification and cannot detect file-less malware.
Innovation Solution
An information processing apparatus that acquires program identifiers from memory execution targets, calculates or retrieves checksums, and verifies these against a white list to determine if the program is permitted to execute, allowing for verification of both file-based and file-less malware.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If file system verification is used to prevent illegal program execution, then programs with physical file form can be verified, but file-less malware executed in memory cannot be detected
Solution Approach 1:
The patent transitions from file system-based verification (one dimension) to memory-based verification (another dimension). By acquiring program identifiers directly from memory execution targets and verifying them against a white list stored in memory, the system extends verification capability to file-less malware that operates exclusively in the memory domain, thus adding a new dimensional approach to malware detection.
Solution Approach 2:
The patent introduces a memory-based white list as an intermediary verification mechanism. Instead of directly relying on file system paths, the system uses in-memory program identifiers and their corresponding white list entries as intermediaries to verify whether executing programs are legitimate. This intermediary layer enables verification of programs that do not have persistent file forms.
2Measurement precision
If verification is performed on the basis of path names or file information, then file-based programs can be identified, but programs without physical file form cannot be verified
Solution Approach 1:
The patent changes the verification parameter from file-based attributes (path names, file information) to memory-based attributes (program identifiers acquired from memory execution targets). By storing and verifying in-memory program identifiers against a white list, the system maintains precise identification capability while becoming applicable to both file-based and file-less program forms.
3Device complexity
If only file-based verification methods are used, then the verification system remains simple, but it cannot detect malware that executes without creating files
Solution Approach 1:
The patent performs preliminary action by pre-storing program identifiers of legitimate programs in a white list within memory before execution occurs. This preliminary preparation enables the verification system to quickly check whether executing program identifiers match the pre-stored white list entries, providing effective malware detection without requiring complex real-time analysis during program execution.
Data Source
AI summary
According to an embodiment, an information processing apparatus includes one or more processors. The one or more processors are configured to acquire a program identifier of a computer program disposed on a memory and serving as an execution target; read a calculation result corresponding to the acquired program identifier from a storage; and verify whether the computer program serving as the execution target is permitted to be executed, on the basis of the read calculation result and a white list.