Processor Page Modification Logging for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security measures in computing devices are inadequate in detecting and preventing malware attacks, particularly those exploiting memory corruption bugs, as they fail to efficiently monitor and log anomalous control flow and memory accesses.
Innovation Solution
Implementing a page modification logging (PML) feature in processors to track page modifications in virtualized environments, using filtering techniques to reduce overhead and focus logging on specific processes, and utilizing extended page tables to log and store access information for malware detection and machine learning optimization.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If comprehensive memory access logging is implemented to detect all malware attacks, then detection capability is improved, but system overhead and log size increase significantly
Solution Approach 1:
The patent segments memory logging into two distinct mechanisms: Page Modification Logging (PML) for tracking write accesses at page granularity, and Memory Management Unit (MMU) logging for tracking read and execute accesses. This segmentation allows each logging mechanism to specialize in specific access types, reducing overall overhead while maintaining comprehensive detection capability.
Solution Approach 2:
The patent implements selective logging where only specific memory accesses are logged based on security policies and process priorities. High-priority processes and suspicious memory regions receive full logging, while low-priority processes use sampling or threshold-based logging. This partial action approach reduces log volume while maintaining effective malware detection.
2Measurement precision
If detailed logging of all memory accesses is performed, then security detection precision is improved, but processing time and energy consumption increase
Solution Approach 1:
The patent pre-identifies high-risk memory regions and processes before malware execution occurs. Security policies pre-mark suspicious processes and memory regions for enhanced logging. When malware attempts to execute, these pre-marked regions are already under scrutiny, enabling faster detection without requiring analysis of all memory accesses.
Solution Approach 2:
The patent replaces traditional software-based logging analysis with hardware-assisted detection mechanisms. The PML and MMU hardware components automatically track and flag suspicious accesses, eliminating the need for software to manually analyze every memory access. This hardware substitution significantly reduces processing time while maintaining detection precision.
3Reliability
If logging is applied to all processes, then comprehensive security monitoring is achieved, but system performance and productivity deteriorate
Solution Approach 1:
The patent applies different logging qualities to different processes based on their security sensitivity. Critical system processes and high-value applications receive full-page modification logging, while less critical processes use coarser-grained monitoring or sampling. This local quality differentiation ensures comprehensive security coverage for important processes while minimizing performance impact on less critical ones.
Solution Approach 2:
The patent implements partial logging where only a subset of memory accesses are logged for each process based on priority levels and security policies. Low-priority processes may have logging enabled only for specific memory regions or during suspicious activity periods, reducing their logging overhead while maintaining overall security monitoring coverage.
Data Source
AI summary
In one embodiment, a processor comprises: a first storage including a plurality of entries to store an address of a portion of a memory in which information has been modified; a second storage to store an identifier of a process for which information is to be stored into the first storage; and a first logic to identify a modification to a first portion of the memory and store a first address of the first portion of the memory in a first entry of the first storage, responsive to a determination that a current identifier of a current process corresponds to the identifier stored in the second storage. Other embodiments are described and claimed.