Transactional Memory for Unauthorized Access Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer security systems face performance degradation when dynamically monitoring code execution for malware detection, as they often rely on resource-intensive methods like single-stepping execution with hypervisors, which can negatively impact system performance.
Innovation Solution
Implementing a computing device with hardware transactional memory support that wraps suspicious code in a transactional envelope, sets breakpoints, and aborts transactions upon unauthorized memory access, allowing for dynamic monitoring without significant performance impact by using transactional execution and abort handling.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If single-stepping execution using a hypervisor is used to dynamically monitor code execution, then malware detection capability is improved, but system performance deteriorates
Solution Approach 1:
The patent replaces the mechanical hypervisor-based single-stepping execution system with a hardware transactional memory system. The processor's built-in transactional memory hardware automatically monitors memory access patterns and detects conflicts, eliminating the need for external hypervisor intervention and reducing the performance overhead associated with software-based monitoring.
Solution Approach 2:
The transactional memory system enables the processor to self-monitor its own execution through hardware-based conflict detection. The processor automatically tracks memory access within transaction boundaries and detects unauthorized accesses without requiring external monitoring infrastructure, thereby improving both detection capability and performance efficiency.
2Productivity
If hardware transactional memory is used to wrap suspicious code, then dynamic monitoring performance is improved, but system complexity increases
Solution Approach 1:
The patent uses the existing hardware transactional memory copy mechanisms to create transactional envelopes around suspicious code segments. The hardware automatically copies and tracks memory access patterns within transaction boundaries, enabling monitoring without adding significant software complexity while maintaining high performance through hardware-based operations.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
Technologies for detecting unauthorized memory accesses include a computing device having transactional memory support. The computing device executes a code segment identified as suspicious and detects a transactional abort during execution of the code segment. The computing device may execute a security support thread concurrently with the code segment that reads one or more monitored memory locations. A transactional abort may be caused by a read of the security support thread conflicting with a write from the code segment. The computing device may set a breakpoint within the code segment, and a transactional abort may be caused by execution of the code segment reaching the breakpoint. An abort handler determines whether a security event has occurred and reports the security event. The abort handler may determine whether the security event has occurred based on the cause of the transactional abort. Other embodiments are described and claimed.