Method and system for detecting malware using memory map
AssigneeLINE Corporation
InventorChangseon Lee
Life of this patent
Estimating the term…
Abstract
A malware detection method and system using a memory map. A malware detection method may include collecting, by processing circuitry, a plurality of memory maps from a plurality of client devices, a client program being installed in each of the plurality of client devices, analyzing, by the processing circuitry, a plurality of memory addresses of the plurality of memory maps to obtain an analysis result, and determining, by the processing circuitry, whether malware is present in one of the plurality of client devices based on the analysis result.
Claims21
A malware detection method performed by a computer apparatus including processing circuitry, the malware detection method comprising:
- collecting, by the processing circuitry, a plurality of memory maps from a plurality of client devices, a client program being installed in each of the plurality of client devices;
- counting, by the processing circuitry, a number of times each respective memory address among a plurality of memory addresses is in use in each of the plurality of memory maps, the plurality of memory addresses being included in each of the plurality of memory maps;
- and
- determining, by the processing circuitry, whether malware is present in a first client device among the plurality of client devices based on a first number of times a first memory address among the plurality of memory addresses is in use among the plurality of memory maps.
A malware detection method performed by a computer apparatus comprising processing circuitry, the malware detection method comprising:
- acquiring, by the processing circuitry, a memory map of the computer apparatus under control of a client program executed on the computer apparatus;
- transmitting, by the processing circuitry, the memory map to a server that provides a service to the computer apparatus through the client program;
- and
- receiving, by the processing circuitry, a signal from the server based on a first number of times a first memory address among a plurality of memory addresses is in use among a plurality of memory maps, the plurality of memory maps including the memory map and at least one other memory map of at least one other computer apparatus.
A computer apparatus comprising:
- processing circuitry configured to cause the computer apparatus to,
- collect a plurality of memory maps from a plurality of client devices, a client program being installed in each of the plurality of client devices,
- count a number of times each respective memory address among a plurality of memory addresses is in use in each of the plurality of memory maps, the plurality of memory addresses being included in each of the plurality of memory maps, and
- determine whether malware is present in a first client device among the plurality of client devices based on a first number of times a first memory address among the plurality of memory addresses is in use among the plurality of memory maps.
Dependencies are inferred from the claim text.