Memory Injection Detection via VAD Region Enumeration
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security solutions are inadequate in detecting and mitigating memory injection attacks, which exploit vulnerabilities in information systems by injecting malicious code into memory regions, often undetected by existing blacklisting and whitelisting methods.
Innovation Solution
A method and system that enumerate memory regions and loaded modules, scanning for memory injections by comparing memory region address information to loaded module address information, generating alarms for unauthorized memory regions containing library indicative coding, and differentiating between Reflective DLL and Skape/JT injections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional blacklisting and whitelisting methods are used for security detection, then the system is easier to operate and implement, but the detection precision and reliability against memory injection attacks deteriorates
Solution Approach 1:
The patent introduces VAD (Virtual Address Descriptor) structures as an intermediary mechanism between the operating system and security detection. These VAD structures contain metadata about memory regions including type, protection attributes, and allocation information, serving as a mediator that enables precise detection of memory injection attacks without requiring complex blacklisting or whitelisting approaches
Solution Approach 2:
The system performs preliminary enumeration and classification of all memory regions using VAD structures before security detection occurs. By pre-establishing the expected memory region map with proper attributes and types, the system can quickly compare against actual memory contents during security scanning, enabling fast and accurate detection of unauthorized memory injections
2Measurement precision
If comprehensive memory scanning is performed to detect all memory regions, then the detection precision improves, but the processing time and system resource consumption increases
Solution Approach 1:
The patent segments the memory space into distinct regions represented by VAD structures, each with specific attributes (commitment state, protection flags, type information). This segmentation allows the security scanner to focus only on relevant memory regions and their specific characteristics rather than scanning entire memory space uniformly, significantly reducing scanning time while maintaining detection precision
Solution Approach 2:
The system performs partial scanning by focusing detection efforts on memory regions that exhibit suspicious characteristics based on VAD metadata (such as regions with executable permissions but no associated file, or regions that don't match expected module patterns). This selective approach achieves sufficient detection precision without the excessive time cost of scanning every byte of memory
3Measurement precision
If detailed analysis of each memory region is performed to differentiate injection types, then the measurement precision improves, but the device complexity increases
Solution Approach 1:
The VAD structures pre-classify memory regions by type (private, shared, mapped, etc.) and record allocation information before security analysis. This preliminary classification provides a structured framework that simplifies the differentiation of injection types (such as Reflective DLL vs. Skape/JT injections) by comparing actual memory contents against the pre-established VAD metadata, reducing the complexity of the analysis logic required
Data Source
Figure 1
Figure 2
Figure 3a
AI summary
Methods of detecting malicious code injected into memory of a computer system are disclosed. The memory injection detection methods may include enumerating memory regions of an address space in memory of computer system to create memory region address information. The memory region address information may be compared to loaded module address information to facilitate detection of malicious code memory injection.