Endpoint Agent Network Access Interception for Malicious App Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security solutions face challenges in detecting and blocking malicious applications that evade detection by hiding or evolving to have good reputation scores, and in minimizing network resource usage while effectively blocking malware.
Innovation Solution
The system employs an endpoint intelligence agent to intercept network access attempts, providing metadata to a network security device that queries threat intelligence servers for file reputation scores, allowing the device to determine actions such as blocking malicious applications, and utilizing a virtual desktop infrastructure to monitor and block malicious traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware detection methods are used, then detection capability is maintained, but malicious applications that evolve or hide their malicious nature can evade detection
Solution Approach 1:
The system performs preliminary actions by establishing baseline behavior profiles for applications before they execute malicious activities. The endpoint intelligence agent continuously monitors and records normal application behavior patterns, enabling early detection when deviations occur. This proactive approach allows the system to detect malware before it can fully execute its malicious payload or before it evolves new evasion techniques.
Solution Approach 2:
The system implements feedback mechanisms where detection results, threat intelligence data, and behavioral analysis outcomes are continuously fed back into the detection engine. The endpoint intelligence agent receives feedback from the network security device about blocked threats and uses this information to refine its detection algorithms. This closed-loop feedback system enables the system to adapt to new malware variants and improve detection accuracy over time.
2Measurement precision
If comprehensive malware scanning and analysis is performed, then detection accuracy is improved, but network resource usage increases
Solution Approach 1:
The system applies local quality by performing comprehensive analysis only when and where it is most needed. The endpoint intelligence agent conducts lightweight local analysis on the endpoint device to identify suspicious behaviors, then selectively requests detailed analysis from the network security device only for potentially malicious applications. This localized approach ensures high detection accuracy for threats while minimizing unnecessary network resource consumption for benign applications.
Solution Approach 2:
The system uses partial action by implementing a tiered analysis approach. Instead of performing full comprehensive scanning on all applications, it first applies quick heuristic analysis to filter out obviously benign applications, then performs partial deep analysis only on suspicious cases. This selective partial analysis maintains high detection accuracy for actual threats while significantly reducing overall network resource usage compared to universal comprehensive scanning.
Data Source
AI summary
Embodiments are configured to receive metadata of a process intercepted on an end host when attempting to access a network. The metadata includes a hash of an application associated with the process and an endpoint reputation score of the application. Embodiments are configured to request a threat intelligence reputation score based on the hash of the application, to determine an action to be taken by the end host based, at least in part, on one or more policies and at least one of the threat intelligence reputation score and the endpoint reputation score, and to send a response indicating the action to be taken by the end host. Further embodiments request another threat intelligence reputation score based on another hash of a dynamic link library module loaded by the process on the end host, and the action is determined based, at least in part, on the other threat intelligence score.