Detecting Unknown Vulnerabilities via Crash Telemetry Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional computer security systems have difficulty detecting unknown security threats, such as zero-day attacks, as they often rely on known vulnerabilities and may not account for exceptions and errors in newly released computing processes, leaving devices susceptible to malicious exploitation.
Innovation Solution
The method involves monitoring computing processes by logging telemetry data, analyzing crash dumps and call stacks to identify unknown vulnerabilities, and performing security actions to prevent malicious exploitation, using modules like monitoring, analysis, and security modules to detect and address vulnerabilities before they can be exploited.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional computer security systems rely on known vulnerabilities for detection, then detection capability for well-known threats is improved, but detection capability for unknown security threats deteriorates
Solution Approach 1:
The system performs preliminary analysis of computing processes by monitoring telemetry data, analyzing crash dumps, and identifying vulnerabilities before they can be exploited. This includes examining call stacks, detecting anomalies in process behavior, and proactively identifying unknown vulnerabilities through pattern recognition in crash data, rather than waiting for threats to manifest
Solution Approach 2:
The system introduces an intermediary analysis layer between the computing process and security detection. This intermediary component captures and analyzes telemetry data, crash dumps, and call stacks to identify vulnerabilities, acting as a mediator that translates raw process data into actionable security intelligence for detecting both known and unknown threats
2Measurement precision
If security systems monitor all computing processes in detail, then detection accuracy is improved, but system complexity and processing overhead increase
Solution Approach 1:
The system extracts only the most relevant and critical data elements from computing processes for analysis, such as specific telemetry metrics, crash dump information, and call stack data. By selectively extracting only the necessary security-critical information rather than monitoring all process data, the system maintains high detection accuracy while reducing processing overhead and complexity
Solution Approach 2:
The system applies different monitoring and analysis strategies to different parts of the computing environment based on their security relevance. Critical areas such as crash handling, exception processing, and vulnerable API calls receive detailed analysis, while less critical areas use lighter monitoring, optimizing the balance between detection accuracy and system complexity
Data Source
Figure 1
Figure 2
Figure 3
AI summary
The disclosed computer-implemented method for detecting unknown vulnerabilities in computing processes may include (1) monitoring a computing environment that facilitates execution of a computing process by logging telemetry data related to the computing process while the computing process is running within the computing environment, (2) determining that the computing process crashed while running within the computing environment, (3) searching the telemetry data for evidence of any vulnerabilities that potentially led the computing process to crash while running within the computing environment, (4) identifying, while searching the telemetry data, evidence of at least one vulnerability of the computing process that is not yet known to exist within the computing process and then in response to identifying the evidence of the computing process's vulnerability, (5) performing at least one security action to hinder any potentially malicious exploitation of the computing process's vulnerability. Various other methods, systems, and computer-readable media are also disclosed.