Memory Write-Protection Re-Patching Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Some malware can re-patch themselves into computer memory locations after being detected and removed by anti-patching techniques, rendering these techniques ineffective.
Innovation Solution
A computer security system that monitors and blocks requests to change the write-protection attributes of memory locations previously affected by malware, using a re-patching detector and memory protector to prevent re-patching by intercepting and preventing modifications to these attributes, and employing a crash protector to handle attempts to write to read-only memory locations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If anti-patching techniques are used to remove malicious software instructions from memory, then malware patches are removed, but malware can re-patch itself into the same memory locations
Solution Approach 1:
The patent applies preliminary anti-action by monitoring memory locations and detecting attempts to modify write-protection attributes before malware can successfully re-patch. The system proactively identifies and blocks re-patching attempts by watching for modifications to memory attributes that would allow malware to insert new malicious instructions, thereby preventing the harmful action before it occurs.
Solution Approach 2:
The patent implements feedback by continuously monitoring memory locations that were previously patched by malware. When an attempt is detected to modify the write-protection attribute of such memory locations, the system responds by blocking the modification and alerting the user. This closed-loop feedback mechanism ensures that re-patching attempts are detected and prevented in real-time.
2Adaptability or versatility
If write-protection attributes of memory locations are made modifiable to allow legitimate software updates, then software can be updated, but malware can exploit this to re-patch malicious code
Solution Approach 1:
The patent applies local quality by differentiating between memory locations based on their history of malware infection. Memory locations that have previously been patched by malware are placed under special monitoring and have their write-protection attributes blocked, while other memory locations retain normal write-protection behavior. This localized approach allows legitimate software updates in unaffected areas while preventing re-patching in vulnerable locations.
Solution Approach 2:
The patent implements preliminary action by proactively blocking write-protection attribute modifications on memory locations that have a history of malware patching, before malware can exploit the modification to re-patch. The system pre-identifies vulnerable memory locations and pre-empts potential re-patching attacks by preventing attribute changes, thereby maintaining security while allowing legitimate updates elsewhere.
3Reliability
If memory locations are marked as read-only to prevent writing, then malware cannot modify them, but legitimate processes may need to write to these locations
Solution Approach 1:
The patent applies segmentation by dividing memory locations into different categories based on their security risk profile. Memory locations that have been previously patched by malware are segmented into a protected category with restricted write-protection attribute modifications, while other memory locations remain in a normal category with standard write permissions. This segmentation allows the system to apply different write-protection rules to different memory regions, protecting vulnerable locations while maintaining normal operation elsewhere.
Data Source
AI summary
Preventing re-patching by malware on a computer by detecting a request to modify a write-protection attribute of a memory location within a memory of a computer to allow the memory location to be written to, where the detecting is performed subsequent to the detection of activity identified as malware-related activity involving the memory location, and preventing modification of the write-protection attribute of the memory location.