Restricted Memory Allocation for Malicious Process Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security systems are unable to detect malicious processes on computing devices until after they have compromised the device, leaving them vulnerable to attacks that exploit security deficiencies.
Innovation Solution
The system identifies a portion of data accessed by processes, allocates a restricted memory section, and detects attempts by processes to access this data using unexpected methods, determining malicious activity and performing security actions to prevent harm.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional security services monitor process behavior to detect malicious activities, then detection accuracy is improved, but detection timing is delayed until after device compromise
Solution Approach 1:
The system performs preliminary actions by allocating a restricted memory section and redirecting data pointers to this restricted section before malicious processes execute. This proactive setup enables early detection when processes attempt to access the redirected data, allowing security intervention before device compromise occurs.
2Reliability
If security systems implement comprehensive process monitoring, then security detection capability is improved, but system complexity increases
Solution Approach 1:
The system extracts and isolates specific critical data into a restricted memory section, focusing monitoring efforts on this particular location rather than implementing comprehensive system-wide monitoring. This selective approach maintains high security detection capability while reducing overall system complexity.
Solution Approach 2:
The restricted memory section acts as an intermediary between legitimate processes and the actual data storage location. By redirecting pointers to this intermediate restricted section, the system enables detection of malicious access attempts without requiring complex monitoring of all process activities.
3Ease of operation
If processes are allowed to access data in unrestricted memory sections, then process functionality is maintained, but security vulnerabilities increase
Solution Approach 1:
The system creates a copy of the data pointer redirection mechanism, where the restricted memory section contains a copy or redirect of the actual data location. This allows legitimate processes to access data through the restricted section as if it were the original location, maintaining functionality while enabling security monitoring.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosed computer-implemented method for detecting malicious processes on computing devices may include (i) identifying a portion of data on a computing device that is stored in an unrestricted section of memory and accessed by processes while running on the computing device, (ii) allocating a restricted section of memory within the computing device and indicating that the portion of data is located in the restricted section of memory, (iii) detecting an attempt by a process running on the computing device to access the portion of data within the restricted section of memory using an unexpected access method, (iv) determining, based at least in part on the process attempting to access the portion of data within the restricted section of memory using the unexpected access method, that the process is malicious, and (v) performing a security action on the computing device to prevent the malicious process from harming the computing device.