Dynamic Linker Security via Statistical Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies lack real-time detection and prevention mechanisms for malicious dynamic linked libraries and scripts, making computing systems vulnerable to attacks through hijacking and execution of malicious files.
Innovation Solution
A statistical classification model is developed to analyze dynamic linked libraries and scripts without loading or executing them, using parameters such as common names, versions, sizes, sources, digital signatures, and obfuscation status to classify potential maliciousness, with security controls implemented to block or audit identified threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a predefined search path is used to locate dynamic linked libraries, then the library loading process is simplified and efficient, but the system becomes vulnerable to malicious libraries placed higher in the search path
Solution Approach 1:
The system performs preliminary analysis of dynamic linked libraries before they are loaded into memory. The heuristic analyzer examines library files against known malicious patterns and behaviors, and the behavioral analyzer monitors library execution to detect suspicious activities. This preliminary detection prevents malicious libraries from being loaded, thereby maintaining the simplicity of the search path mechanism while blocking attacks before they can execute.
Solution Approach 2:
The patent introduces an intermediary security system between the application and the dynamic linked library loading process. This intermediary includes a heuristic analyzer that intercepts library files during the search path traversal, analyzes them for malicious characteristics, and blocks suspicious libraries before they can be loaded. This intermediary layer maintains the ease of operation by not changing the search path mechanism itself, while adding security through the intermediary analysis step.
2Reliability
If existing detection schemes are used for malicious libraries, then some detection capability is provided, but real-time detection and prevention is not achieved
Solution Approach 1:
The system employs dynamic analysis through the behavioral analyzer, which monitors library execution in real-time to detect malicious behaviors. Unlike static analysis that requires full library loading, the behavioral analyzer observes actual runtime characteristics such as unexpected function calls, memory manipulation patterns, and interaction with sensitive system resources. This dynamic approach enables real-time detection without requiring complete library loading, thus maintaining both reliability and productivity.
Solution Approach 2:
The patent replaces traditional mechanical library loading mechanisms with a virtualized analysis environment. The virtual machine or sandboxed environment allows the system to execute library code for analysis without actually loading it into the main application's memory space. This substitution enables real-time detection of malicious behaviors while preventing the performance overhead and security risks associated with full library loading.
3Reliability
If dynamic linked libraries are analyzed before loading, then malicious libraries can be detected, but the analysis process adds complexity to the loading mechanism
Solution Approach 1:
The security analysis system is segmented into distinct functional components: a heuristic analyzer for static pattern matching, a behavioral analyzer for runtime monitoring, and a virtual machine for isolated execution. Each component operates independently with specific responsibilities, allowing the complex analysis task to be divided into manageable segments. This segmentation maintains reliability through comprehensive analysis while managing complexity through modular architecture, where each segment can be developed and maintained separately.
Data Source
AI summary
Disclosed embodiments relate to systems and methods for statistically analyzing and classifying dynamically linked libraries and computing scripts. Techniques include identifying a plurality of libraries, developing a statistical classification model, implementing the statistical classification model, classifying, based on the implementing, an operational phase library to be potentially malicious, and implementing a security control for the library. Further techniques include identifying a plurality of computing scripts, developing a statistical classification model, implementing the statistical classification model, classifying, based on the implementing, an operational computing script to be potentially malicious, and implementing, for the classified operational computing script, a security control action.