# JITScanner: Just-in-Time Executable Page Check in the Linux Operating System +
## 3 The JITScanner System  
### Baseline Concepts and Methodology  
The design principle of JITScanner is simple yet effective: we perform a binary code security check on an executable page _only when that page content is actually materialized in memory and is accessed for an instruction fetch_. This approach detects malware that decrypts malicious stages during the execution, and thwarts malicious code which delays execution to evade sandboxing.  
At a high level of description, Figure 1 allows outlining the central difference between JITScanner and literature solutions for malware detection. In particular, the common way of proceeding in the literature consists of working at either the application loading time (e.g., with the static analysis of software and/or with the instrumentation via hooks--as in antivirus products) or the application runtime (e.g., via the interception of calls to services, such as system-library or system-call usage). However, between these two phases malware  
\begin{table}
\begin{tabular}{l c c c c c c c} \hline \hline  & **JITS** & **MAAR**[10] & **ClamAV**[14] & **Tracee**[16] & **Deep-Hook**[11] & **Falco**[17] & **[PERSON] et al.**[22] \\ \hline Can be used on & & & & & & & \\ non-virtualized & ✓ & ✓ & ✓ & ✗ & ✓ & ✓ \\ environment & & & & & & & \\ \hline Allows for dynamic & & & & & & & \\ analysis & ✓ & ✓ & ✗ & ✓ & ✓ & ✓ & ✓ \\ \hline Remains effective & & & & & & & \\ against packed & ✓ & ✓ & ✗ & ✓ & ✓ & ✓ & ✓ \\ malware & & & & & & & \\ \hline Uses signatures & & & & & & & \\ check & ✓ & ✗ & ✓ & ✗ & ✓ & ✗ & ✓ \\ \hline Reduces memory & & & & & & & \\ search ranges & ✓ & na & ✗ & na & ✗ & na & ✗ \\ \hline Allows monitoring & & & & & & & & \\ of multiple memory & & & & & & & \\ writes on & & & & & & & \\ executable pages & & & & & & & \\ \hline \hline \end{tabular}
\end{table}
Table 1: Comparison of JITScanner with literature solutions.  
software can also perform decryption steps of its own code during its execution, which is not directly interceptable by these load/execution steps based solutions. In JITScanner, we have the possibility to check any piece of code in an executable page just when execution on that page (re)-starts, possibly after a dynamic modification of the page content. Hence, from the actual usage of pieces of code fetched by the CPU for their execution, we enable taking snapshots of the code image in an executable page for their analysis. Overall, our approach ultimately combines dynamic with static analysis, as code (a snapshot of it) is analyzed at the time of its actual execution in a just-in-time fashion.  
The malware detection conducted by JITScanner is based upon basic principles, specifically the reliance on page-fault handlers for intercepting and managing the CPU fetch of instructions from executable pages. Although JITScanner is the first solution to leverage this mechanism for the purpose of conducting memory analysis on Linux systems--while also including WX pages--the ideas it relies on are essentially reusable in any other operating system family. Overall, the methodology JITScanner exploits lies naturally on contemporary address space management solutions in common software systems. We believe this widens the applicability of our ideas.  
In the following sections, we delve into the details of the architecture and technical approaches that underpin the design of JITScanner.