TLB Watcher Detects Malware via ITLB DTLB Discrepancies

The patent introduces a TLB watcher as an intermediary component that monitors translation look-aside buffers to detect malware. The TLB watcher acts as a mediator between the CPU and memory management unit, observing address mappings without interfering with normal memory operations. By watching for suspicious patterns in the TLB (such as unauthorized mappings or mappings to protected memory regions), the system can detect hidden malware while maintaining normal system performance and stealth evasion resistance.

The patent extracts the detection function from the main CPU execution path by implementing a separate TLB watcher module. This extracted component specifically monitors translation look-aside buffer operations independently from normal instruction execution. By separating the detection functionality into a dedicated watcher that observes TLB events (such as page table walks, address translations, and memory mapping changes), the system achieves reliable malware detection without significantly increasing overall system complexity, as the watcher operates as a lightweight side-channel monitor.

The patent implements periodic scanning of translation look-aside buffers by the TLB watcher, rather than continuous monitoring of all memory operations. The watcher periodically examines address mappings in the ITLB (instruction TLB) and DTLB (data TLB) for suspicious patterns. This periodic action allows the system to maintain high detection precision by regularly checking for malware indicators while minimizing processing overhead by not continuously interrupting normal CPU operations. The periodic scans occur at strategically chosen moments when TLB events naturally occur, reducing time loss.