Endpoint DLL Anomaly Detection via Hashed Representation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting anomalous DLL loading in computing environments are inefficient, leading to network saturation and performance issues due to the continuous transmission of process and DLL identification information, overwhelming both endpoint devices and management devices.
Innovation Solution
Endpoint devices generate an endpoint-independent representation of loaded DLLs and transmit a one-way hash or the representation only when a process exits, reducing data transmission and processing load on management devices, allowing for efficient detection of anomalous behavior using machine learning techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If process and DLL identification information is continuously transmitted to management devices for anomaly detection, then detection capability is improved, but network saturation and performance issues occur
Solution Approach 1:
The patent extracts only the essential identification information (process ID and DLL ID) from the continuous data stream and transmits it periodically when processes exit, rather than transmitting all process data continuously. This extraction approach maintains detection capability while significantly reducing network traffic volume.
Solution Approach 2:
Instead of continuous transmission, the system implements periodic action by transmitting identification information only at specific moments when processes exit. This periodic transmission pattern reduces network saturation while maintaining sufficient data for anomaly detection through machine learning models.
2Measurement precision
If detailed process and DLL information is transmitted for analysis, then detection accuracy is improved, but processing load on management devices increases
Solution Approach 1:
The system extracts only critical identification fields (process ID, DLL ID) from the full process data structure, transmitting minimal necessary information to management devices. This extraction maintains detection accuracy by preserving key identifiers while reducing processing load through elimination of redundant data.
Solution Approach 2:
Instead of transmitting original detailed process data, the system creates simplified copies containing only essential identification information. These copied data structures maintain the necessary identifiers for anomaly detection while significantly reducing the complexity and processing requirements at management devices.
3Reliability
If continuous monitoring of DLL loading is implemented, then security detection is improved, but endpoint device performance deteriorates
Solution Approach 1:
The system implements periodic monitoring action by collecting DLL loading information and transmitting it only when processes exit, rather than continuously monitoring and transmitting during process execution. This periodic approach maintains security detection reliability while minimizing performance impact on endpoint devices during active process execution.
Solution Approach 2:
The system performs preliminary collection of identification information during process execution, storing it locally without immediate transmission. This preliminary action allows the monitoring data to be gathered in advance, and then transmitted efficiently when processes exit, maintaining security detection while preserving endpoint device performance during critical execution periods.
Data Source
AI summary
An endpoint device monitors loading of dynamically loaded libraries (DLLs) by a process, such as during execution of the process on the endpoint device. The endpoint device can generate an endpoint-independent representation of the DLLs upon exiting of the process. The endpoint device may generate a hash, such as a one-way hash, of the endpoint-independent representation. The endpoint device may transmits the process and the hash to a management device to detect in a machine learning manner whether loading of the DLLs during the execution of the process was anomalous.