Memory Snapshot Structural Analysis for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional malware detection methods that rely on scanning for signatures are ineffective against malware that repackages itself to evade detection, as these methods do not account for structural changes made by malware to hide within legitimate processes.
Innovation Solution
The method involves obtaining structural information from snapshots of system memory, comparing it with a process model, and generating a malware alert if structural anomalies are found, indicating potential malware infection by analyzing hashes or fuzzy hashes of executable regions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If signature-based scanning is used for malware detection, then detection speed is improved, but detection accuracy deteriorates because malware can repackage itself to change signatures
Solution Approach 1:
The patent changes the detection parameter from static file signatures to dynamic structural characteristics of processes in memory. By analyzing process tree structures, parent-child relationships, and executable region layouts, the system detects malware based on structural anomalies rather than fixed signatures, maintaining detection speed while improving accuracy against repackaged malware
Solution Approach 2:
The patent transitions from static signature matching to dynamic structural analysis of running processes. By continuously monitoring process structures in system memory and comparing them against known good states, the system adapts to detect malware that changes its signature, making the detection mechanism dynamic rather than static
2Measurement precision
If structural analysis of process memory is performed, then detection accuracy is improved, but computational complexity increases
Solution Approach 1:
The patent segments the complex task of malware detection into specific structural components: process tree analysis, parent-child relationship verification, and executable region structure examination. By dividing the analysis into discrete structural elements, the system manages computational complexity while maintaining high detection accuracy through focused structural validation
3Reliability
If comprehensive structural comparison is performed on all processes, then detection reliability is improved, but processing time increases
Solution Approach 1:
The patent extracts and compares only the critical structural elements of processes (process tree topology, parent-child relationships, executable region structures) rather than performing comprehensive analysis of all process data. This selective extraction of structural features maintains detection reliability by focusing on malware-indicative patterns while reducing processing time through targeted comparison
Data Source
AI summary
Examples relate to snapshots of system memory. In an example implementation, structural information of a process in a snapshot of system memory is compared with hashes or fuzzy hashes of executable regions of the same process in a previous snapshot of system memory to determine whether there is a structural anomaly.