Virtual Address Mapping for Kernel-Level Application Functionality Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems lack the ability to detect and manage the high-level functionalities and behavioral activities of applications, particularly third-party applications, at the platform or kernel level, making it difficult to prevent security exploits like Cross Site Scripting without visible traces at the system or device level.
Innovation Solution
A system and method that utilizes a virtual address mapping table to map virtual addresses in application binary code to corresponding target application functionalities, allowing a high-level operating system to detect and manage these functionalities, enabling better platform control and security measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the platform monitors system libraries and device level activities, then it can detect some application behaviors, but it cannot detect high-level application functionalities like web security exploits that leave no traces at the system level
Solution Approach 1:
The patent implements a nested monitoring structure where the kernel layer contains a virtual address mapping table that maps application virtual addresses to kernel-space representation addresses. This nested approach allows the platform to monitor high-level application functionalities by translating them into kernel-level observable events, enabling detection of web security exploits and other high-level behaviors without adding complex external monitoring mechanisms.
Solution Approach 2:
The patent introduces a virtual address mapping table as an intermediary between the application layer and the kernel layer. This mapping table acts as a mediator that translates application virtual addresses into kernel-space representation addresses, allowing the kernel to indirectly observe and detect application behaviors without directly interfering with application execution or requiring complex application-level instrumentation.
2Reliability
If the platform implements comprehensive monitoring of application binary code, then it can detect malicious activities, but it increases system complexity and overhead
Solution Approach 1:
The patent extracts only the essential monitoring information by maintaining a virtual address mapping table that contains only the critical virtual addresses of interest from application binary code. Instead of monitoring all application code, the system extracts and tracks only specific virtual addresses that correspond to important functionalities, reducing monitoring complexity while maintaining security effectiveness.
Solution Approach 2:
The patent performs preliminary analysis by pre-establishing the virtual address mapping table before application execution. The mapping between application virtual addresses and kernel-space representation addresses is prepared in advance, allowing the kernel to directly monitor application behaviors without performing complex real-time analysis during execution, thus reducing runtime overhead and system complexity.
3Productivity
If the system tracks virtual addresses in application binary code, then it can detect target functionalities in real-time, but it requires maintaining additional data structures increasing memory usage
Solution Approach 1:
The patent applies local quality by making the virtual address mapping table application-specific. Each application has its own dedicated mapping table containing only the virtual addresses relevant to that particular application, rather than using a single large table for all applications. This localized approach reduces memory consumption while enabling fast, application-specific detection.
Solution Approach 2:
The patent implements partial monitoring by tracking only specific virtual addresses of interest rather than all virtual addresses in the application binary code. The virtual address mapping table contains only the essential addresses corresponding to target functionalities, allowing real-time detection with minimal memory overhead by monitoring a subset of addresses rather than the complete address space.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, methods, and computer programs are disclosed for detecting high-level functionality of an application executing on a computing device. One method comprises storing, in a secure memory on a computing device, a virtual address mapping table for an application. The virtual address mapping table comprises a plurality of virtual addresses in the application binary code mapped to corresponding target application functionalities. The application is registered with a high-level operating system (HLOS). During execution of the application binary code, the HLOS detects when one or more of the virtual addresses corresponding to the target application functionalities are executed based on the virtual address mapping table.