Endpoint Information Leakage Tracking via Heap and API Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information leakage prevention systems in endpoint environments can only identify where a leakage occurs and respond accordingly, but they cannot track which file is being leaked, by whom, when, or how, and are unable to detect encoded files, limiting their effectiveness in responding to malicious code distribution.
Innovation Solution
A system and method that include a management server generating detection pattern information for personal and keyword data, transmitting it to endpoint terminals, where first and second detection activities are performed by matching patterns with heap memory and API execution information, and transmitting results back to the server for response execution and storage, enabling detailed tracking and response to information leakage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional information leakage prevention systems inspect data for pattern matching, then leakage detection capability is provided, but tracking capability (who, when, how) and encoded file detection are lost
Solution Approach 1:
The detection activity is divided into multiple independent detection activities (first detection activity for heap memory matching, second detection activity for API monitoring) that can be executed separately and combined later, allowing detailed tracking of leakage events without compromising detection accuracy
Solution Approach 2:
Detection pattern information is generated and stored in advance before actual leakage occurs, enabling the system to quickly match and track leakage events when they happen, providing both immediate detection and comprehensive tracking capability
2Ease of operation
If only pattern matching inspection is performed, then simple leakage detection is achieved, but detailed tracking and encoded file detection are impossible
Solution Approach 1:
The detection system is designed to perform multiple functions through the same framework: pattern matching detection, heap memory analysis, API monitoring, and tracking of leakage events, allowing the system to handle both simple detection and complex tracking requirements
Solution Approach 2:
Detection pattern information acts as an intermediary that bridges the gap between simple pattern matching and complex tracking requirements, enabling the system to maintain ease of operation while achieving detailed tracking and encoded file detection capabilities
Data Source
AI summary
Disclosed is a system for tracking an information leakage of an endpoint. The system includes a management server which transmits the detection pattern information to an endpoint terminal connected through a network and an endpoint terminal which monitors generation and change of a file by using the detection pattern information, performs a first detection activity through matching information stored in a heap memory of a currently-executed process with the detection pattern information, and a second detection activity according to monitoring of a particular application program interface (API) according to process execution, executes an information leakage response process corresponding to first detection activity information and second detection activity information, and transmits the first detection activity information and the second detection activity information to the management server.