Anomalous DLL Loading Detection with Locality-Sensitive Hashing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for detecting malicious dynamic-link library (DLL) side-loading in Windows-based systems are reactive and ineffective, particularly when the modification to legitimate DLLs is minimal, and machine learning techniques fail to detect heavily modified malicious DLLs.
Innovation Solution
A method involving locality-sensitive hashing (LSH) is used to calculate the LSH value of a DLL, compare it to centroids of known normal DLLs, and determine if the distance exceeds a risk threshold to identify anomalous loading, utilizing a backend system and goodware collection for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If behavior monitoring is used to detect malware, then detection can be performed during execution, but it is ineffective against DLL side-loading because the application program executes normally
Solution Approach 1:
The system performs preliminary hashing of legitimate DLL files and stores them in a database before they are potentially compromised. When a DLL is loaded, the system compares its hash against the pre-stored legitimate hash values. This preliminary action enables proactive detection of DLL side-loading attacks without requiring complex runtime behavior monitoring of the application program.
2Reliability
If file signature matching is used to detect malicious DLLs, then known malicious DLLs can be identified, but it is reactive and cannot detect newly modified DLLs
Solution Approach 1:
The system pre-computes and stores hash values of legitimate DLL files in a database before any potential attacks occur. This allows for immediate comparison and detection of modified DLLs without requiring reactive scanning or signature updates, thus eliminating the time loss associated with traditional reactive detection methods.
Solution Approach 2:
The system replaces the mechanical process of reactive file signature matching with a computational hash comparison system. By substituting the traditional signature-based approach with hash value comparison against pre-stored legitimate DLL hashes, the system achieves both high detection accuracy and immediate response time.
3Reliability
If machine learning techniques are used to detect malicious DLLs, then heavily modified DLLs can be detected, but they are ineffective when modifications to legitimate DLLs are minimal
Solution Approach 1:
The system replaces complex machine learning models with a simpler hash-based comparison mechanism. By computing hash values of DLL files and comparing them against pre-stored legitimate hashes, the system achieves reliable detection of even minimal modifications without requiring the computational complexity of machine learning algorithms.
4Measurement precision
If locality-sensitive hash comparison is used to detect malicious DLLs, then similar DLLs can be identified, but samples of malicious DLLs must first be obtained making it reactive
Solution Approach 1:
Instead of collecting malicious DLL samples and comparing against them (the traditional approach), the system inverts the approach by collecting and hashing legitimate DLL files, then comparing suspicious DLLs against these legitimate hashes. This inversion eliminates the need for malicious sample collection and enables immediate detection without the time loss associated with sample gathering.
Data Source
AI summary
Anomalous loading of a dynamic-link library (DLL) is detected on a desktop computer. When the file of the DLL is not a known normal file, the locality sensitive (LSH) values of files of known versions of a known normal DLL that corresponds to the DLL are obtained from an LSH repository and compared to the LSH value of the file of the DLL. The smallest distance between the LSH value of the file of the DLL and each of the LSH values from the repository is selected for comparison to a risk threshold. The Loading of the DLL is detected to be an anomaly when the smallest distance is not less than the risk threshold.