API Call Interception for Blocking Untrusted File Access
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security programs typically rely on signature checks to detect malicious programs like ransomware and malware, which are ineffective against unknown threats and generate false positives, allowing these programs to encrypt and access user files.
Innovation Solution
Implementing a security system that intercepts API calls, evaluates the trust level of processes by comparing attributes to known processes and call operations, and blocks untrusted processes from accessing APIs used for file manipulation, with user override options.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature check is used to detect malicious programs, then known threats can be identified, but unknown threats cannot be detected and false positives occur
Solution Approach 1:
The system performs preliminary actions by intercepting API calls before they execute and evaluating process trust levels in advance. The security system proactively blocks potentially malicious processes from accessing sensitive APIs, preventing threats before they can harm the system rather than reacting after signature detection.
Solution Approach 2:
The patent introduces an intermediary security system between the process and the API. This intermediary layer intercepts, evaluates, and mediates API calls based on process trust levels, creating a buffer that prevents both known and unknown threats from accessing sensitive operations while allowing legitimate processes to function.
2Reliability
If API access is restricted for unknown processes, then security is improved, but legitimate processes may be blocked causing false positives
Solution Approach 1:
The system applies local quality by differentiating treatment based on process trust levels. Instead of a blanket block, the security system evaluates individual process characteristics and applies appropriate restrictions only to untrusted processes, while allowing trusted processes full API access. This localized approach maintains security without unnecessarily impacting legitimate operations.
Solution Approach 2:
The patent implements feedback mechanisms where the security system continuously monitors process behavior and updates trust level assessments. This feedback loop allows the system to learn from process behavior patterns and adjust restrictions dynamically, reducing false positives while maintaining strong protection against actual threats.
Data Source
AI summary
Examples of the present disclosure describe systems and methods for restricting access to application programming interfaces (APIs). For example, when a process calls an API, the API call may be intercepted by a security system for evaluation of its trustfulness before the API is allowed to run. Upon intercepting an API call, the process calling the API may be evaluated to determine if the process is known to the security system, such that known processes that are untrusted may be blocked from calling the API. Further, when the security system cannot identify the process calling the API, the security service may evaluate a call stack associated with the call operation to determine if attributes of the call operation are known to the security system. If the call operation is known to the security system as untrusted, the call operation may be blocked from calling the API.