Virtual Memory Mapping Analysis for Process Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Operating systems that do not provide visibility into running processes on a computing device pose a security risk, as malicious programs can access sensitive information without detection, particularly in environments handling private user data like payment processing systems.
Innovation Solution
A detection process that mimics the operating system's memory mapping to identify and analyze attributes of virtual memory mappings, determining if other processes are sharing physical memory, thereby identifying potentially malicious programs and preventing unauthorized access.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If operating systems do not provide visibility into running processes, then system security is compromised and malicious programs can access sensitive information, but providing process visibility increases system complexity and resource consumption
Solution Approach 1:
The patent segments the process detection functionality into a separate detection process that operates independently from the main operating system. This detection process creates virtual memory mappings and analyzes them to identify running processes, thereby providing security monitoring without requiring the entire OS to be more complex or invasive.
Solution Approach 2:
The patent introduces an intermediary detection process that acts as a mediator between the need for security monitoring and the OS's process visibility limitations. This intermediary uses memory mapping analysis to indirectly detect processes without requiring direct OS support or modification, thus maintaining system simplicity while improving security.
2Measurement precision
If a detection process analyzes memory mapping attributes to identify running processes, then process detection capability is improved, but computational resources and time are consumed
Solution Approach 1:
The detection process performs preliminary actions by pre-creating virtual memory mappings that match expected process patterns before actual process execution. This allows the system to quickly compare actual memory mappings against pre-established patterns, enabling fast process detection without extensive real-time analysis.
Solution Approach 2:
The patent changes detection parameters by analyzing specific attributes of memory mappings (such as protection flags, offset addresses, and file descriptors) rather than examining entire process structures. This selective parameter analysis reduces computational overhead while maintaining detection precision.
3Measurement precision
If the detection process creates virtual memory mappings to detect other processes, then detection accuracy is improved, but memory resource consumption increases
Solution Approach 1:
The detection process applies local quality by creating virtual memory mappings with specific, targeted characteristics that match expected process behaviors rather than creating comprehensive mappings of all system memory. This localized approach maintains detection accuracy for relevant processes while minimizing overall memory consumption.
Solution Approach 2:
The patent uses disposable virtual memory mappings that are created temporarily for detection purposes and then discarded. These short-lived mappings serve their detection function and are cleaned up, preventing permanent memory consumption while maintaining detection accuracy during the active detection period.
Data Source
AI summary
Techniques for determining whether processes are running on a computing device are described. As an example, a detection process may create a virtual mapping of data to memory of the computing device. The detection process may access a file system storing special files including attributes of virtual memory mappings. The detection process may analyze the attributes of the virtual memory mapping, such as an amount of data stored or shared by the memory mapping, to determine that another process is sharing the memory mapping with the detection process. The detection process may send data to a server associated with the computing device indicating that a process other than the detection process is operating on the computing device.