Runtime Memory Protection Engine for Code Injection Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for protecting computer applications against code injection attacks are inadequate, as they fail to effectively detect and mitigate sophisticated attacks that exploit vulnerabilities in memory permissions and thread creation requests.
Innovation Solution
A system comprising a Runtime Memory Protection (RMP) user endpoint agent and kernel driver component that monitors memory locations for events such as memory permissions changes, write requests, and thread creation, declaring a code injection attack and implementing protection actions like suspending or terminating threads, and migrating processes to prevent attack execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing protection methods are used, then basic security is maintained, but sophisticated code injection attacks exploiting memory permissions and thread creation vulnerabilities cannot be detected
Solution Approach 1:
The system segments the protection mechanism into two distinct components: a kernel driver component that operates at the core system level and a user endpoint agent that operates at the application level. This segmentation allows each component to specialize in specific detection tasks, improving overall detection capability without overwhelming system complexity. The kernel driver handles low-level memory and thread events while the user agent processes high-level attack patterns.
Solution Approach 2:
The user endpoint agent serves as an intermediary between the kernel driver and the application being protected. It receives event representations from the kernel driver, processes them through wrapper functions, and determines whether code injection attacks are occurring. This intermediary layer enables sophisticated detection while maintaining system stability by filtering and interpreting raw events before taking protection actions.
2Reliability
If monitoring of memory permissions changes and thread creation requests is implemented, then code injection attacks can be detected, but system performance and operation speed may be reduced
Solution Approach 1:
The system implements partial monitoring by focusing specifically on critical events related to code injection attacks (memory permissions changes, thread creation requests) rather than monitoring all system events. The wrapper functions selectively intercept only the system calls relevant to attack detection, processing a subset of events that are most indicative of malicious activity while leaving other system operations unaffected.
Solution Approach 2:
The system employs feedback mechanisms where the user endpoint agent continuously monitors event representations from the kernel driver, analyzes them through wrapper functions, and adjusts its detection behavior based on the patterns observed. When suspicious patterns are detected, the system responds with protection actions while maintaining normal operation for legitimate processes, thereby balancing detection accuracy with system performance.
3Object-affected harmful factors
If protection actions such as thread suspension and process termination are implemented, then attack execution is prevented, but legitimate application functionality may be disrupted
Solution Approach 1:
The system applies preliminary anti-action by implementing protection actions (thread suspension, process termination, handle dropping) as preventive measures when code injection attacks are detected. Rather than waiting for damage to occur, the system proactively interrupts malicious execution by suspending suspicious threads or terminating compromised processes before the injected code can execute and cause harm.
Solution Approach 2:
The user endpoint agent acts as an intermediary that carefully evaluates event representations before triggering protection actions. It uses wrapper functions to analyze the context and determine whether an event represents a genuine attack or legitimate application behavior. This intermediary evaluation layer ensures that protection actions are taken only when necessary, minimizing disruption to legitimate application functionality while maintaining strong security.
Data Source
AI summary
Embodiments protect computer applications from code injection attacks. An example embodiment includes a runtime memory protection (RMP) user endpoint agent and an RMP kernel driver component. The RMP user endpoint agent receives, from the RMP kernel driver component, representations of events occurring with respect to memory locations associated with a computer application and processes the received representations to determine if a given event includes at least one of a memory permissions change request, a memory write request, and a thread create request. If the given event is determined to include at least one of a memory permissions change request, a memory write request, and a thread create request, the RMP user endpoint agent declares a code injection attack and sends an alarm indication to the RMP kernel driver component. In response to receiving the alarm indication, the RMP kernel driver component implements a protection action.