DLL Fingerprint Comparison for Side-Loading Attack Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods are inadequate in effectively defending against dynamic-link library (DLL) side-loading attacks, where malicious actors exploit vulnerabilities by replacing trusted DLLs with malicious ones, and prior techniques struggle to detect new variations of malicious code.
Innovation Solution
A DLL security controller is introduced that calculates and compares DLL fingerprints, determining if a superseded path exists and identifying malicious DLLs by comparing these fingerprints to reference fingerprints, both locally and through a central facility, to execute security actions and protect the computing device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware detection methods are used, then detection of known malware is possible, but detection of new variations of malicious code fails
Solution Approach 1:
The patent changes the detection parameter from signature-based matching to fingerprint-based comparison. By calculating DLL fingerprints based on import addresses and comparing them against reference fingerprints, the system can detect both known and new variations of malicious code. This parameter change enables the system to maintain high detection accuracy while adapting to new malware variants that lack traditional signatures.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a fingerprint comparison system. Instead of relying on predefined malware signatures, the system calculates cryptographic fingerprints of DLL files and compares them against known good references. This substitution enables detection of new malware variations through anomaly detection rather than pattern matching.
2Reliability
If DLL side-loading protection is implemented, then security against malicious DLLs is improved, but system complexity increases
Solution Approach 1:
The patent segments the security solution into distinct functional components: a DLL security controller that calculates and compares fingerprints, and a central facility that stores reference fingerprints and distributes security updates. This segmentation allows the complex security functionality to be distributed across multiple modules, making the system more manageable and maintainable while providing comprehensive DLL protection.
Solution Approach 2:
The patent introduces a central facility as an intermediary between the DLL security controller and the reference fingerprint database. This intermediary handles the distribution of reference fingerprints, collection of telemetry data, and updates to the security system, thereby simplifying the architecture by centralizing management functions and reducing direct complexity at the endpoint security controller.
3Measurement precision
If fingerprint comparison is performed locally and remotely, then detection accuracy is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary action by pre-calculating and storing reference DLL fingerprints in a central facility before runtime. During security verification, the system compares local DLL fingerprints against these pre-prepared references, significantly reducing processing time compared to calculating all fingerprints from scratch. This preliminary preparation enables fast security decisions while maintaining high accuracy through comprehensive fingerprint comparison.
Data Source
AI summary
Methods, apparatus, systems, and articles of manufacture are disclosed to defend against dynamic-link library (DLL) side-loading attacks. An example apparatus includes a fingerprint generator to determine a first DLL fingerprint of a first DLL stored at a first OS path referenced by an operating system (OS) event generated by a computing device, and, in response to determining that a second DLL having the same name as the first DLL is stored at a second OS path superseding the first OS path, determine a second DLL fingerprint of the second DLL, a fingerprint comparator to determine whether at least one of the first or the second DLL fingerprint satisfies a deviation threshold based on a comparison of the first and the second DLL fingerprint to a reference DLL fingerprint, and a security action enforcer to execute a security action to protect a computing device from an attack.