Volatile Memory Scanning Triggering and Downselection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cybersecurity techniques fail to detect fileless malware attacks executed in volatile memory, as they do not scan volatile memory and incur significant computational performance penalties when attempting to do so.
Innovation Solution
Implementing a computing system with modules to selectively trigger volatile memory scans based on specific sequences of computational events and downselect the scope of memory scans by type and permissions, avoiding frequent scans that degrade performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the computing system scans the entirety of volatile memory storage to detect fileless malware, then detection capability is improved, but computational performance deteriorates significantly
Solution Approach 1:
The patent divides volatile memory into multiple regions and selectively scans only those regions that contain executable instructions, rather than scanning the entire volatile memory space. This segmentation approach maintains detection capability while reducing the scanning scope to improve computational performance.
Solution Approach 2:
The patent applies different scanning strategies to different memory regions based on their characteristics. High-priority memory regions that are more likely to contain malware are scanned more frequently and thoroughly, while low-priority regions receive less scanning attention, optimizing the balance between detection and performance.
2Loss of time
If the computing system performs frequent volatile memory scans to detect ephemeral malware, then detection timeliness is improved, but system performance degradation increases
Solution Approach 1:
The patent implements periodic scanning of volatile memory regions at different intervals based on their priority and risk level. Critical memory regions are scanned more frequently, while less critical regions are scanned less often, maintaining detection timeliness for important areas while reducing overall scanning overhead.
Solution Approach 2:
The patent dynamically adjusts scanning frequency and scope based on system conditions, detected threats, and memory region characteristics. The scanning strategy adapts in real-time to balance detection requirements with system performance, intensifying scans when threats are detected and reducing scans when the system is clean.
Data Source
AI summary
Methods and systems implement computing systems configured to trigger a volatile memory scan based on execution of computer-executable instructions, and to downselect scope of a volatile memory scan. Such techniques for triggering scans are sufficiently selective to avoid volatile memory scans for each and every running process, or vast majority of running processes. Moreover, volatile memory scans are triggered responsively after the computer-executable instructions are run, so that target processes to be scanned have not yet terminated at the time of the volatile memory scan. Additionally, a variety of techniques are implemented to minimize the volatile memory scans adversely impacting computational performance of the computing system.