DLL Side-Loading Detection Using Signature and Prevalence Profiling
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing operating systems are vulnerable to DLL side loading attacks, where malicious DLLs are loaded by exploiting the system's search order for DLLs, leading to potential security breaches.
Innovation Solution
A method and system for detecting DLL side loading attacks by applying filtering and profiling criteria to verify that applications and DLLs are loaded from the same folder, ensuring the application is signed and verified, and the DLL lacks a valid signature, with additional scoring based on prevalence and entropy checks to determine malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the operating system searches for DLLs in a predefined ordered list of locations without requiring full paths, then ease of operation is improved, but security reliability deteriorates due to DLL hijacking and side loading attacks
Solution Approach 1:
The patent applies preliminary action by checking the location of DLLs against a whitelist of approved paths before loading them into memory. This pre-verification step prevents malicious DLLs from being loaded even though the system allows flexible DLL search paths, thus maintaining ease of operation while improving security reliability
Solution Approach 2:
The patent introduces an intermediary component (the detection system) that sits between the DLL search mechanism and the actual DLL loading process. This intermediary verifies whether found DLLs are located in approved paths before allowing them to be loaded, thus resolving the contradiction between flexible DLL loading and security
2Ease of operation
If the system allows applications to omit full DLL paths and use the predefined search order, then ease of operation is improved, but the system becomes vulnerable to malicious attacks
Solution Approach 1:
The patent applies preliminary anti-action by proactively detecting and blocking DLLs that are not located in approved paths before they can be executed. The system preemptively identifies potential malicious DLLs by checking their locations against the whitelist, preventing attacks before they occur while maintaining the flexible DLL search capability
3Reliability
If the system implements strict verification of DLL locations and signatures, then security reliability is improved, but device complexity increases
Solution Approach 1:
The patent reduces complexity by performing verification checks preliminarily - checking DLL locations against a pre-defined whitelist of approved paths before the actual loading process. This approach simplifies the verification logic compared to continuous monitoring, as the approval criteria are established in advance
Solution Approach 2:
The patent changes the verification parameter from complex behavioral analysis to simple location matching. Instead of monitoring multiple aspects of DLL behavior and signatures, the system focuses on verifying whether the DLL path matches entries in the approved whitelist, thus improving reliability while minimizing complexity
Data Source
AI summary
A method for detecting a cyber-attack includes identifying an event occurring in a computer belonging to a computer system, the event including loading of an application to memory together with a Dynamic Link Library (DLL). A filtering criterion is applied to the event, to verify that (i) the application and the DLL are loaded from the same folder, (ii) the application is signed and verified and (iii) the DLL does not have a valid signature. Responsively to meeting the filtering criterion, a profiling criterion is applied to the event, to verify that prevalences of defined characteristics of the DLL in the computer system are below defined prevalence levels. Responsively to meeting the profiling criterion, a decision is made that the DLL is suspected of being malicious.