Variable Write Profile for Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security systems struggle to effectively detect and prevent intrusions by monitoring memory access patterns and identifying deviations from normal behavior, especially in programs with varying memory access patterns.
Innovation Solution
A computer-implemented method that identifies a set of program variables, generates a profile of variable writes by tracking memory write operations and timestamps, and detects deviations in memory access patterns to generate a notification indicating an attack status.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If memory access patterns are monitored to detect intrusions, then detection accuracy is improved, but system complexity increases
Solution Approach 1:
The patent segments the monitoring system into distinct components: a profiler that creates write profiles during normal execution, a monitor that tracks actual memory accesses, and a comparator that detects deviations. This segmentation allows each component to perform its function independently, improving detection accuracy while managing system complexity through modular design.
Solution Approach 2:
The system performs preliminary action by creating write profiles during a profiling phase before actual intrusion detection begins. These profiles establish the baseline normal behavior of the program, allowing the monitor to efficiently detect deviations without requiring complex real-time analysis of all memory access patterns from scratch.
2Reliability
If detailed tracking of memory write operations is performed, then intrusion detection capability is improved, but processing overhead increases
Solution Approach 1:
The patent applies local quality by focusing monitoring resources on specific variables identified in the write profile rather than uniformly monitoring all memory operations. The system tracks write counts and timestamps only for variables that are part of the established profile, reducing processing overhead while maintaining reliable intrusion detection for critical data structures.
Solution Approach 2:
The system changes parameters by transitioning from continuous detailed monitoring to periodic comparison against the write profile. The monitor tracks write operations using counters and timestamps, comparing these parameters against the pre-established profile to detect deviations, thereby reducing processing overhead while maintaining detection capability.
3Measurement precision
If a write profile is generated and compared against actual accesses, then false positives are reduced, but memory usage increases
Solution Approach 1:
The patent uses copying by creating a write profile that replicates the normal write behavior pattern of the program. This profile serves as a reference copy that can be compared against actual memory accesses without requiring the original source code or detailed execution traces, reducing memory usage while maintaining precision in detecting false positives.
Data Source
Figure 1A~1B
Figure 2
Figure 3
AI summary
A computer-implemented method is disclosed. The method includes: identifying a set of program variables associated with a computer program; generating a profile of variable writes for the computer program based on tracking, for each variable in the set of program variables: a count of memory write operations for writing to the variable; and timestamps associated with the memory write operations; detecting a trigger condition associated with the set of program variables, the detecting including: monitoring a pattern of memory accesses by the computer program, the pattern of memory accesses indicating accesses of memory allocated to variables in the set of program variables; and detecting a deviation of the pattern of memory accesses from the profile of variable writes; and in response to detecting the trigger condition, generating a notification indicating an attack status on the computer program.