Thread Hollowing Malware Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems are inadequate in mitigating malware attacks without disrupting the normal operation of computer processes, particularly in high-availability systems, as they often require application termination or relaunching to prevent malware execution.
Innovation Solution
The implementation of a malware detection module that iterates through a virtual memory address space to identify vulnerable regions, combined with a thread hollowing module that renders specific process threads inoperable, allowing for non-disruptive mitigation of malware attacks by overwriting affected memory regions with no-ops and controlling thread execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing malware protection systems terminate or relaunch applications to prevent malware execution, then malware attack mitigation is improved, but system availability and continuous operation deteriorate
Solution Approach 1:
The system segments the process into multiple threads and identifies the specific thread containing malware. By rendering only the infected thread inoperable rather than terminating the entire process, the system maintains continuous operation of clean threads while mitigating the malware attack.
Solution Approach 2:
The system applies different treatments to different parts of the process: the infected thread is rendered inoperable while other threads continue normal operation. This localized response preserves system availability while effectively mitigating the specific malware threat.
2Reliability
If the system renders specific process threads inoperable to stop malware, then malware execution is prevented, but process functionality may be disrupted
Solution Approach 1:
The system identifies and isolates the specific thread containing malware by analyzing thread stack walks and comparing against known malware signatures. By targeting only the infected thread rather than the entire process, functionality in other threads is preserved.
Solution Approach 2:
The system continuously monitors thread execution and provides feedback about malware detection. When malware is detected in a specific thread, the system responds by rendering that thread inoperable, then continues monitoring remaining threads to ensure overall process functionality is maintained.
Data Source
AI summary
A method and system for mitigating a malware attack are disclosed herein. A malware detection module iterates over a virtual memory address space associated with a process executing on a computer system. The malware detection module identifies a region of memory likely to be vulnerable to a malware attack. Responsive to identifying the region of memory, a thread hollowing module determines a specific process thread associated with the identified region of memory. The thread hollowing module renders the specific process thread inoperable.