Tree structure for storing monitored memory page data

A system for detecting changes to a data structure, the data structure comprising nodes, including at least a base node, each of the nodes having contents thereof stored in a corresponding memory page, the contents of one or more of the nodes including information identifying at least a portion of protected memory pages of a memory, the system comprising:

• a hardware platform;
• and
• a system software configured to support execution of applications on the hardware platform and to:
• additionally designate the memory pages storing contents of the nodes of the data structure as protected memory pages of the memory;
• responsive to receiving an indication of a write to a first memory page indicated as protected, traverse the data structure starting at the base node using a base pointer to determine if the first memory page corresponds to one of the memory pages storing contents of the nodes or one of the at least the portion of protected memory pages, wherein the base pointer is stored in a first memory space, wherein the at least the portion of protected memory pages are stored in a second memory space, wherein the first memory space is not accessible by software executing within the second memory space;
• and
• perform an alert action responsive to determining that the first memory page corresponds to one of the memory pages storing contents of the nodes or one of the at least the portion of protected memory pages.

A non-transitory computer-readable medium storing instructions that, when executed by a processor, cause the processor to perform a method for detecting changes to a data structure, the data structure comprising nodes, including at least a base node, each of the nodes having contents thereof stored in a corresponding memory page, the contents of one or more of the nodes including information identifying at least a portion of protected memory pages of a memory, the method comprising:

• additionally designating the memory pages storing contents of the nodes of the data structure as protected memory pages of the memory;
• responsive to receiving an indication of a write to a first memory page indicated as protected, traversing the data structure starting at the base node using a base pointer to determine if the first memory page corresponds to one of the memory pages storing contents of the nodes or one of the at least the portion of protected memory pages, wherein the base pointer is stored in a first memory space, wherein the at least the portion of protected memory pages are stored in a second memory space, wherein the first memory space is not accessible by software executing within the second memory space;
• and
• performing an alert action responsive to determining that the first memory page corresponds to one of the memory pages storing contents of the nodes or one of the at least the portion of protected memory pages.