Trap Code Injection for Malicious Memory Access Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current anti-malware systems face challenges in detecting malicious code attempting to access protected data stored in system cache, as legitimate processes can inadvertently access kernel addresses, leading to false positives and inefficiencies in monitoring.
Innovation Solution
Injecting trap code into the execution path of processes to allocate a trap address range, which is not accessible by legitimate applications, allowing for focused monitoring and detection of malicious activity by triggering notifications or restrictions when unauthorized access occurs.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If trap code is injected to allocate trap address range for detecting malicious code, then detection precision is improved, but device complexity increases
Solution Approach 1:
The patent introduces trap code as an intermediary component that allocates a trap address range between the monitoring system and the executing process. This trap address range acts as a mediator to detect unauthorized memory access attempts without requiring direct integration between the monitor and process, thereby improving detection precision while managing complexity through modular design
Solution Approach 2:
The patent segments the address space by creating a dedicated trap address range separate from legitimate application addresses. This segmentation allows the system to monitor specific suspicious address ranges without overseeing the entire memory space, improving detection precision while reducing the complexity of comprehensive monitoring
2Measurement precision
If comprehensive monitoring of all application accesses is performed, then detection precision is improved, but productivity deteriorates
Solution Approach 1:
The patent applies local quality by focusing monitoring efforts specifically on the trap address range rather than uniformly monitoring all application accesses. This localized approach maintains high detection precision for malicious code attempts while minimizing the overhead impact on overall system productivity
Solution Approach 2:
The patent implements partial monitoring by only tracking accesses to the specifically allocated trap address range rather than performing comprehensive monitoring of all application memory accesses. This partial action approach achieves sufficient detection precision for security threats while preserving system productivity
Data Source
AI summary
Provided are a computer program product, system, and method for injecting trap code in an execution path of a process executing a program to generate a trap address range to detect potential malicious code. A specified type of command is processed in application code and, in response, trap code is executed to allocate a trap address range. The specified type of command is executed in the application code. A determination is made as to whether an accessing application accesses the trap address range. At least one of transmitting a notification that the accessing application comprises potentially malicious code, monitoring the execution of the accessing application, and restricting execution of the accessing application is performed in response to determining that the accessing application accessed the trap address range.