Runtime Memory Behavior Mapping for Unknown Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection methods are ineffective against unknown malware and exploits, as they rely on signature recognition and cannot detect unexpected behavior caused by malicious software.
Innovation Solution
A method involving the creation of a map of expected memory behavior for applications or services by analyzing raw memory snapshots, with deviations triggering alerts and allowing for the detection of compromised processes through monitoring function calls and memory behavior comparisons.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based memory scanning is used to detect malware, then detection of known malware is achieved, but detection of unknown malware and exploits is ineffective
Solution Approach 1:
The patent changes the detection parameter from static malware signatures to dynamic behavior characteristics. Instead of scanning for known signature patterns, the system monitors runtime behavior parameters such as memory access patterns, function call sequences, and execution flow characteristics. This parameter transformation enables detection of unknown malware that lacks known signatures but exhibits anomalous behavioral patterns.
Solution Approach 2:
The system performs preliminary action by establishing a baseline model of normal application behavior before malware execution occurs. Memory snapshots are captured during normal operation to create reference profiles of expected behavior. When runtime behavior deviates from these pre-established baselines, anomalies are detected. This preliminary characterization of normal behavior enables proactive detection of unknown threats.
2Ease of manufacture
If traditional malware detection methods are used, then implementation is straightforward, but detection precision against exploits is insufficient
Solution Approach 1:
The patent substitutes mechanical signature-matching mechanisms with behavioral analysis systems. Instead of mechanically comparing memory contents against signature databases, the system uses dynamic monitoring of execution behavior, memory access patterns, and runtime characteristics. This substitution replaces static pattern recognition with dynamic behavioral observation, significantly improving exploit detection precision while maintaining implementation feasibility through automated monitoring.
Solution Approach 2:
The system implements feedback mechanisms where runtime behavior is continuously monitored and compared against established baselines. When deviations are detected, the system provides feedback by generating alerts and triggering further analysis. This closed-loop feedback enables continuous refinement of detection accuracy, allowing the system to adapt to new exploit patterns while maintaining straightforward implementation through automated feedback-driven detection.
Data Source
AI summary
There is provided a method for improving security of computer resources, including obtaining raw memory snapshots of a computer memory of one or more computing systems during runtime of identical processes relating to a predetermined application or a service; forming a map of expected memory behaviour relating to the application or the service based on the obtained raw memory snapshots; monitoring the memory behaviour of a computing system during the execution of the same application or the service; comparing the monitored memory behaviour of the computing system with the formed map of expected memory behaviour; and in the event that a deviation from the expected memory behaviour is detected based on the comparison, triggering an alert.