Memory Layout Fingerprinting for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-virus software often fails to detect previously unknown malicious code and is not practical for all hardware platforms, necessitating a more effective method to detect and prevent malicious code execution.
Innovation Solution
The approach involves generating and comparing memory layout fingerprints of applications to identify deviations from known good fingerprints, allowing for real-time monitoring and detection of malicious code by mapping and analyzing memory patterns of executing processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-virus software is installed to detect malicious code, then detection capability is improved, but compatibility with hardware platforms deteriorates
Solution Approach 1:
The patent replaces traditional anti-virus software mechanisms with a hardware-based monitoring system that uses memory management unit (MMU) data and page table information. This substitution eliminates the need for software agents on each platform, providing universal compatibility across different hardware architectures while maintaining detection capability through hardware-level memory layout analysis.
Solution Approach 2:
The patent introduces a memory layout fingerprinting intermediary layer that analyzes memory structures without requiring direct access to application code or execution. By using page table information and memory region data as intermediaries, the system can detect malicious modifications across diverse platforms without platform-specific software dependencies.
2Measurement precision
If anti-virus software is used to detect known malicious code, then detection accuracy is improved, but ability to detect unknown malicious code deteriorates
Solution Approach 1:
The patent establishes baseline memory layout fingerprints for legitimate applications before execution. By pre-characterizing the memory structure of known good applications and storing these fingerprints for comparison, the system can detect deviations caused by malicious code injection, providing both accurate known malware detection and capability to identify previously unknown threats through anomaly detection.
Solution Approach 2:
The patent implements continuous monitoring that compares real-time memory layout data against established baselines. This feedback mechanism enables the system to detect both known malicious patterns (through direct fingerprint matching) and unknown threats (through deviation detection from normal behavior patterns), resolving the contradiction between detection accuracy and adaptability to new threats.
3Reliability
If memory layout monitoring is implemented to detect malicious code, then detection effectiveness is improved, but system complexity deteriorates
Solution Approach 1:
The patent extracts only the essential memory layout characteristics (page table information, memory region boundaries, protection bits) needed for fingerprinting, ignoring other complex system states. By focusing extraction on the minimal sufficient data subset from the operating system's memory management structures, the system achieves effective malicious code detection without requiring complex monitoring of entire system states.
Solution Approach 2:
The patent applies different monitoring strategies to different memory regions based on their characteristics. Critical regions (such as executable segments and library areas) receive detailed fingerprinting and comparison, while less critical regions use simplified monitoring. This localized quality approach maintains detection effectiveness in high-risk areas while reducing overall system complexity through selective detailed analysis.
Data Source
AI summary
Techniques for monitoring based on a memory layout of an application are disclosed. A memory layout may be received, obtained, and/or generated from an application executing on a computer. Based on one or more attributes of a plurality of memory regions of the memory layout a memory layout fingerprint is generated. Additionally, memory region fingerprints are generated based on the one or more attributes for respective memory regions. The memory layout fingerprint and the memory region fingerprints are compared to respective previous memory layout fingerprints and the memory region fingerprints in order to determine whether malicious code and/or application drifting has occurred.