API Parameter Analysis for Malicious Data Exploitation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security products fail to detect new attack techniques that use data already present in an application's address space to exploit vulnerabilities, as these techniques do not write data into the address space and are thus not detected by current monitoring systems.
Innovation Solution
The method involves hooking an application programming interface (API) of an application, monitoring for calls made to the hooked API, analyzing parameters for malicious characteristics indicating an attempt to use data within the application's address space to execute malware, and performing remediation actions when such characteristics are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If security products monitor address spaces to detect malicious code writing, then detection capability against traditional attacks is improved, but new attack techniques using existing data in address space are not detected
Solution Approach 1:
The patent segments the monitoring approach into two distinct layers: (1) traditional address space monitoring for detecting code injection, and (2) parameter analysis monitoring for detecting exploitation of existing data. This segmentation allows each monitoring layer to specialize in detecting specific attack vectors, thereby improving overall detection capability without missing either traditional or new attack techniques.
Solution Approach 2:
The patent adds a new dimension to security monitoring by analyzing API call parameters, which is a different dimension from traditional address space monitoring. Instead of only watching for memory writes, the system now examines the parameters passed to API functions, creating a multi-dimensional detection approach that captures both traditional code injection attacks and new exploitation techniques that use existing data.
2Object-affected harmful factors
If attackers use data already present in address space to execute malware, then the attack evades detection by security products, but the system remains vulnerable to exploitation
Solution Approach 1:
The patent introduces parameter analysis as an intermediary detection mechanism between the application's API calls and the underlying address space. By examining parameters passed to API functions, the system creates an intermediate layer of inspection that can detect malicious intent in how existing data is being used, without needing to directly monitor or modify the address space itself.
Solution Approach 2:
The patent performs preliminary analysis of API parameters before the actual execution of potentially malicious operations. By checking parameters early in the call chain, the system can identify and block exploitation attempts before they execute, preventing the harmful effect rather than just detecting it after the fact.
Data Source
AI summary
An attempted exploit of a vulnerability of an application executed by a computer is detected. The exploit attempts to call an application programming interface (API) and abuse application data through a malicious parameter of the call. The API of the application is hooked and monitored for a call made to the hooked API. A parameter of the call is analyzed to determine whether the parameter has a malicious characteristic indicating an attempt to use data within an address space of the application to execute malicious software. A remediation action is taken responsive to determining that the parameter has a malicious characteristic.