Memory Tracking for Malware Detection via Segmented Maps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing malware inspection tools face difficulties in accurately determining which memory pages are used by malicious processes and which are used by the inspection elements themselves, leading to decreased efficacy in malware detection and artifact extraction.
Innovation Solution
A device is equipped with a malware inspection element and a memory tracking element that are inserted into a process under test, with the memory tracking element generating a memory map to distinguish between memory pages used by the process and those used by the inspection element, thereby improving malware detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If malware inspection elements are inserted into the process under test, then malware detection capability is improved, but difficulty in determining which memory pages are used by the process versus the inspection element increases
Solution Approach 1:
The patent segments memory tracking by creating separate memory maps: one for the process under test and another for the malware inspection element. This segmentation allows clear distinction between memory pages used by the process versus those used by the inspection element, resolving the difficulty in memory page attribution while maintaining improved malware detection capability.
2Reliability
If all memory pages are tracked to ensure complete malware detection, then detection thoroughness is improved, but processing resource consumption increases
Solution Approach 1:
The patent extracts and isolates the memory pages used by the malware inspection element into a separate memory map. This allows the system to track only the relevant process memory pages for malware detection purposes, rather than tracking all memory pages including those used by inspection elements, thereby reducing processing resource consumption while maintaining detection thoroughness.
3Loss of information
If memory tracking is performed for all processes including inspection elements, then complete process visibility is improved, but malware detection accuracy decreases due to inability to distinguish process memory from inspection element memory
Solution Approach 1:
The patent implements segmentation by creating distinct memory maps that separate process memory from inspection element memory. This segmentation maintains complete visibility into both process and inspection element memory while improving malware detection accuracy by enabling precise attribution of memory page usage to the correct entity.
Data Source
AI summary
A device may load a process under test into virtual memory associated with the device. The virtual memory may include a plurality of memory pages. The device may insert a malware inspection element and a memory tracking element into the process under test and may provide a notification of an event associated with the process under test to a memory tracking element. The device may identify, using the memory tracking element, one or more memory pages of the plurality of memory pages. The one or more memory pages may be assigned to, and used by, the process under test. The device may generate, based on identifying the one or more memory pages, a memory map, associated with the process under test, that may include information identifying the one or more memory pages as being assigned to, and used by, the process under test.