Hardware-Accelerated Memory Security Service for Malicious Activity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions for detecting malicious activities such as ransomware, malicious URLs, and DGA malware are insufficient as they rely on static analysis and external monitoring, making it difficult to detect new unknown malware and encrypted or obfuscated threats.
Innovation Solution
A hardware-accelerated security service is hosted on an integrated circuit's acceleration hardware engine, using a machine learning detection system to analyze data stored in memory and classify malicious activity by extracting features from snapshots of memory data, employing models like random-forest classification for ransomware, binary classification for malicious URLs, and two-stage classification for DGA domains.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static analysis and external monitoring are used for detecting malicious activities, then existing security solutions can operate with simple architecture, but the detection capability for new unknown malware and encrypted threats is insufficient
Solution Approach 1:
The patent replaces traditional static analysis mechanisms with machine learning-based dynamic detection. The system uses ML models that analyze memory snapshots and behavioral patterns to detect malicious activities, substituting the mechanical/static approach with an intelligent/dynamic one that can identify unknown threats.
Solution Approach 2:
The patent introduces an intermediary layer between the host system and detection system. A security service runs in a separate domain (first domain) that collects memory snapshots and behavioral data from the host (second domain), acting as a mediator that bridges the gap between simple host monitoring and complex threat detection.
2Productivity
If traditional security solutions are used, then system resource consumption is lower, but detection speed and real-time response capability are insufficient
Solution Approach 1:
The patent performs preliminary actions by continuously collecting memory snapshots and behavioral data in advance, building up a dataset that can be quickly analyzed when threats are detected. This pre-collection enables faster real-time detection without requiring intensive resource consumption at the moment of detection.
Solution Approach 2:
The system dynamically adjusts its monitoring intensity based on detected behaviors. Normal operations are monitored with lower resource consumption, while suspicious activities trigger enhanced analysis. This dynamic approach optimizes the balance between detection speed and resource usage.
3Measurement precision
If memory data is analyzed in real-time, then detection accuracy for encrypted threats improves, but data processing complexity and computational requirements increase
Solution Approach 1:
The patent extracts only the necessary features and patterns from memory data for analysis. Instead of processing entire memory contents, the system extracts specific behavioral indicators, system calls, and memory access patterns that are relevant for threat detection, reducing processing complexity while maintaining accuracy.
Solution Approach 2:
The patent segments the memory analysis process into discrete components: collecting memory snapshots, extracting features, analyzing behaviors, and classifying threats. This segmentation allows each component to be optimized independently and reduces the overall computational complexity by breaking down the complex task into manageable parts.
Data Source
AI summary
Apparatuses, systems, and techniques for detecting that one or more computer programs executed by a host device are subject to malicious activity using a machine learning (ML) detection system. An integrated circuit is coupled to physical memory of a host device via a host interface. The integrated circuit hosts a hardware-accelerated security service to protect one or more computer programs executed by the host device. The security service extracts a set of features from data stored in the physical memory, the data being associated with the one or more computer programs. The security service determines, using the ML detection system, whether the one or more computer programs are subject to malicious activity based on the set of features. The security service outputs an indication of the malicious activity responsive to a determination that the one or more computer programs are subject to the malicious activity.