In-Memory Malware Detection for Code Reflection Using Process Subsets
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware detection systems struggle to identify malicious executables that employ code reflection techniques, as they leave no forensic artifacts on disk and obfuscate their instruction sets, making in-memory scans difficult and resource-intensive.
Innovation Solution
A feature extractor and machine learning operation that analyzes a subset of a running process's memory, capturing features like byte n-grams, strings, and entropy to classify potential malware, using a machine learning model trained on known malware patterns, thereby detecting malware in memory without relying on at-rest file signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If in-memory scans are performed to detect malware that employs code reflection, then malware detection capability is improved, but resource consumption increases and system performance deteriorates
Solution Approach 1:
The patent extracts and analyzes only specific subsets of process memory (such as heap, stack, or code segments) rather than performing comprehensive in-memory scans of entire process spaces. This selective extraction approach maintains malware detection capability while significantly reducing the computational resources required compared to analyzing all memory contents.
Solution Approach 2:
The patent segments the memory analysis task by dividing process memory into distinct regions or subsets that can be analyzed independently. By focusing on specific memory segments that are most likely to contain malicious code reflection patterns, the system achieves effective malware detection without the overhead of scanning entire memory spaces.
2Measurement precision
If comprehensive in-memory analysis is performed to detect obfuscated malware, then detection precision is improved, but analysis time increases
Solution Approach 1:
The patent performs preliminary filtering and preprocessing of memory data before detailed analysis. By first identifying suspicious memory regions or patterns that indicate potential code reflection, the system can then focus detailed analysis only on those specific areas, maintaining high detection precision while reducing overall analysis time compared to comprehensive scanning.
Solution Approach 2:
The patent applies partial analysis by examining only the most relevant portions of memory that are likely to contain malicious patterns. Rather than performing exhaustive analysis of all memory contents, the system focuses on critical subsets, achieving sufficient detection precision for security purposes while significantly reducing analysis time.
3Ease of operation
If traditional signature-based detection is used for at-rest files, then ease of operation is maintained, but adaptability to reflected malware is lost
Solution Approach 1:
The patent replaces traditional mechanical signature-matching approaches with machine learning-based pattern recognition. The system uses trained models to automatically identify characteristics of code reflection techniques in memory, providing adaptability to various malware types while maintaining ease of operation through automated analysis without requiring manual signature updates for each new threat.
Data Source
AI summary
A process subset of an executing process is obtained from a memory of a computing device. The process subset includes less than all of an in-memory executable program generated by the executing process. A feature vector is extracted from the process subset based on data within the process subset. A malware classification is generated based on the process subset. A remediation operation is initiated on the executing process based on the malware classification.