Pestware Detection via Dynamic Offset Memory Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software is inadequate in detecting and removing pestware from computer systems, particularly when it is disguised as legitimate processes, obfuscated, or polymorphic, leading to difficulties in recognition and removal.
Innovation Solution
A method and system that scans executable memory by enumerating processes and dependencies, identifying reference points, and using dynamic offset scanning to detect pestware by analyzing memory portions offset from these points, employing API implementations as reference points when necessary, and comparing retrieved op code with known pestware patterns to accurately identify malicious processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional scanning methods are used to detect pestware, then the scanning process is simple, but the detection accuracy is low because pestware is disguised as legitimate processes or obfuscated
Solution Approach 1:
The patent segments the memory scanning process into multiple distinct phases: enumeration of processes and dependencies, identification of reference points, scanning of offset memory portions, and analysis of op codes. This segmentation allows each phase to be optimized independently, improving detection accuracy while managing system complexity through modular design
Solution Approach 2:
The patent performs preliminary actions by first enumerating all processes and their dependencies, then identifying reference points in memory before conducting the actual pestware detection scan. This preliminary mapping of the memory landscape enables more accurate and targeted detection, reducing false positives while maintaining systematic complexity
2Reliability
If comprehensive memory scanning is performed to detect all pestware variations, then detection coverage is improved, but scanning time and system performance are degraded
Solution Approach 1:
The patent applies local quality by scanning only specific portions of memory at offset distances from identified reference points, rather than performing a comprehensive scan of entire memory spaces. This targeted approach maintains high detection coverage for pestware while significantly reducing the time and resources required compared to exhaustive scanning methods
Solution Approach 2:
The patent uses partial action by focusing scanning efforts on critical memory regions around reference points where pestware is most likely to be located. This partial scanning strategy provides sufficient detection coverage for malicious processes while avoiding the time penalty of scanning entire memory spaces
3Adaptability or versatility
If static scanning signatures are used to identify pestware, then the scanning method is simple, but it fails to detect polymorphic pestware that changes its memory characteristics
Solution Approach 1:
The patent implements dynamics by using dynamic offset scanning that adapts to the actual memory layout and characteristics of running processes. Instead of relying on static signatures, the system dynamically identifies reference points and scans offset portions based on the specific process being analyzed, enabling detection of polymorphic pestware while managing complexity through adaptive algorithms
Data Source
AI summary
Systems and methods for managing multiple related pestware processes on a protected computer are described. One embodiment is configured to identify a location of each of a plurality of files in at least one file storage device of the protected computer and store a list of the location of each of the plurality of files. The list of the plurality of files is then sorted so as to generate a sorted list. Each of the plurality of files is then sequentially accessed as listed in the sorted list so as to retrieve information from each of the plurality of files. Information from the plurality of files is then analyzed to determine whether any of the plurality of files are potential pestware files. In variations, the files in the file storage device are enumerated, and information from the files is accessed, by circumventing the operating system of the protected computer.