API Hooking for Backdoor Connection Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing computer systems lack effective methods to detect and prevent malicious backdoor connections, allowing unauthorized remote control of devices and access to sensitive information.

Innovation Solution

A computer-implemented method that hooks an API, monitors and intercepts calls to prevent the establishment of backdoor connections by analyzing structures within the intercepted calls and preventing them from reaching a socket on the computer, thereby blocking malicious attempts to remotely control the device.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If traditional security measures are used, then basic protection is provided, but malicious backdoor connections can still establish unauthorized remote control

Engineering Contradiction:

Improvesecurity protectionVSAvoidbackdoor connection establishment

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent applies preliminary action by hooking the CreateProcess API in advance to intercept process creation calls before they can establish backdoor connections. This proactive monitoring allows the system to detect and block malicious attempts to create remote access processes, preventing unauthorized connections before they can be established.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent uses an intermediary approach by introducing a detection module that acts as a mediator between the CreateProcess API and the actual process creation. This intermediary layer analyzes process creation requests, examining structures like STARTUPINFO to identify suspicious patterns indicative of backdoor connections while allowing legitimate processes to proceed normally.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Difficulty of detecting and measuring

If API monitoring is implemented to detect backdoor connections, then security detection capability is improved, but system complexity increases

Engineering Contradiction:

Improvebackdoor connection detectionVSAvoidsecurity system structure

Core Design Contradiction:

Difficulty of detecting and measuringVSDevice complexity

Solution Approach 1:

The patent applies universality by designing a multi-functional detection module that performs multiple security tasks through a single integrated system. The module hooks the CreateProcess API, intercepts and analyzes process creation calls, examines data structures for suspicious patterns, and blocks malicious processes, thereby providing comprehensive backdoor detection and prevention without requiring multiple separate security components.

Inventive Principle:

Principle #6Universality (Multi-functionality)

3Object-affected harmful factors

If process creation calls are intercepted and analyzed, then unauthorized processes are blocked, but legitimate process execution may be affected

Engineering Contradiction:

Improveunauthorized process executionVSAvoidlegitimate process execution

Core Design Contradiction:

Object-affected harmful factorsVSEase of operation

Solution Approach 1:

The patent applies local quality by implementing targeted analysis of specific data structures within process creation calls, such as examining the STARTUPINFO structure and its members (hStdInput, hStdOutput, hStdError) for socket redirection patterns. This localized examination approach allows the system to identify malicious backdoor connections with specific characteristics while minimizing interference with legitimate processes that do not exhibit these suspicious patterns.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS8683576B1Systems and methods for detecting a process to establish a backdoor connection with a computing device

Publication Date: 2014.03.25 CA TECH INC

AI summary

A computer-implemented method for detecting a process to establish a backdoor connection with the computer is described. An application programming interface (API) is hooked. Calls to the hooked API are monitored. A call directed to the hooked API is intercepted. The call instructs the API to initiate a user interface. Structures included in the intercepted call are analyzed. The intercepted call is prevented from arriving at the hooked API if the structures are directed to a socket on the computer.