Anomalous Event Detection via Memory Dump Convolution Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing detection technologies are ineffective in identifying new techniques of vulnerability exploitation, such as return-oriented programming, and fail to detect anomalies indicative of attacks on computer systems, necessitating a method to focus on external symptoms of attacks rather than the evolving exploitation methods.
Innovation Solution
A system and method that detect anomalous events in a computing device's operating system by analyzing the address space dump of a software process, transforming selected features into a convolution, and determining popularity through a database to identify if an event is anomalous based on a threshold value.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing detection technologies use known techniques and mechanisms to detect vulnerability exploitation, then detection capability for known vulnerabilities is improved, but detection capability for new exploitation techniques deteriorates
Solution Approach 1:
Instead of detecting exploitation techniques directly (which change continuously), the patent inverts the approach by detecting the effects and symptoms of exploitation in memory dumps. The system analyzes memory content, code page information, and process state to identify anomalies, rather than trying to recognize specific attack patterns. This inversion allows the system to detect both known and unknown exploitation techniques effectively.
Solution Approach 2:
The patent transforms the detection problem from pattern recognition to parameter analysis. By examining memory dump parameters such as code page characteristics, memory region properties, and process execution state, the system detects anomalies that indicate exploitation attempts. This parameter-based approach adapts to new techniques without requiring updates to detection signatures.
2Reliability
If defensive technologies focus on preventing specific exploitation techniques, then protection against known attacks is improved, but protection against evolving attacks deteriorates
Solution Approach 1:
The patent introduces memory dump analysis as an intermediary between the exploitation attempt and the detection system. Rather than directly monitoring for specific attack patterns, the system captures memory state information and analyzes it for anomalies. This intermediary approach provides reliable detection while maintaining adaptability to new techniques, as the memory dump contains evidence of all exploitation attempts regardless of their specific methodology.
3Measurement precision
If detection systems analyze detailed exploitation patterns, then detection accuracy for specific attacks is improved, but detection speed and resource usage deteriorate
Solution Approach 1:
The patent extracts only the essential information needed for detection from memory dumps, rather than analyzing complete exploitation patterns. By focusing on key parameters such as code page information, memory region properties, and process state, the system achieves sufficient detection accuracy while maintaining high speed and low resource consumption. The extraction of critical features from raw memory data enables efficient anomaly detection.
Data Source
AI summary
A system and method is provided for detecting anomalous events based on a dump of an address space of a software process in a memory of a computing device. An exemplary method includes detecting at least one event occurring in an operating system of the computing device during an execution of the software process, determining a context of the detected event, wherein the context comprises a dump of an address space of the software process containing code that was being executed at the moment of occurrence of the detected event, selecting a set of features of the dump for use in determining whether or not the event is anomalous, transforming the selected set of features of the dump into a convolution, determining a popularity of the convolution by polling a database, and determining that the detected event is an anomalous event if the determined popularity is below a threshold value.