Exploit of Privilege Detection via Privilege List Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware detection systems face challenges in detecting 'exploit of privilege' (EoP) attacks, where vulnerabilities are exploited to modify process privileges, leading to unintended and malicious behavior, as these modifications can appear routine or harmless and are often undetected.
Innovation Solution
An EoP detection system that employs scanning, explicit, and implicit detection methods to compare current process privileges with initial or learned privilege lists, analyzing token identification information and intercepting function calls to identify potential EoP attacks by detecting stolen or maliciously modified tokens.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If current malware detection systems are used, then system simplicity is maintained, but detection capability against EoP attacks is insufficient
Solution Approach 1:
The detection system is divided into multiple independent modules: a privilege list generation module that creates baseline privilege information, a detection module that intercepts function calls and compares actual privileges against the baseline, and a reporting module that generates alerts. This segmentation allows each module to perform a specific function efficiently while maintaining overall system reliability against EoP attacks.
Solution Approach 2:
The system performs preliminary action by generating a privilege list containing baseline privilege information for each process before monitoring begins. This pre-established reference data enables the detection module to quickly compare actual process privileges during runtime without requiring complex real-time analysis, thereby improving detection capability while controlling complexity.
2Measurement precision
If privilege monitoring is implemented, then detection precision is improved, but system performance is reduced
Solution Approach 1:
The detection module focuses monitoring efforts on specific critical function calls related to privilege operations rather than all system calls. By concentrating detection resources on locally important privilege-related functions, the system achieves high detection precision for EoP attacks while minimizing the performance overhead associated with comprehensive monitoring.
Solution Approach 2:
The system creates a copy of the baseline privilege list in memory for comparison during runtime. Instead of repeatedly accessing and parsing the original privilege definitions, the detection module compares actual process privileges against this in-memory copy, which significantly reduces the computational overhead of each comparison operation while maintaining detection precision.
3Reliability
If token modification detection is added, then security against EoP attacks is improved, but ease of operation is reduced
Solution Approach 1:
The detection module automatically performs privilege comparisons and generates detection reports without requiring manual configuration or intervention. The system self-manages the monitoring process, comparing process privileges against the baseline privilege list and automatically identifying discrepancies that indicate EoP attacks, thereby maintaining high security while reducing operational complexity.
Solution Approach 2:
The system implements feedback by continuously monitoring process privileges and comparing them against the baseline, automatically generating alerts when modifications are detected. This automated feedback loop provides real-time security monitoring without requiring manual inspection or intervention, improving security while maintaining ease of operation through automation.
Data Source
AI summary
A non-transitory storage medium having stored thereon logic, the logic being executable by one or more processors to perform operations including comparing a current privilege of a first process with an initial privilege of the first process recorded in a privilege list, and responsive to determining a change exists between the current privilege of the first process and the initial privilege of the first process that is greater than a predetermined threshold, determining the first process is operating with the current privilege due to an exploit of privilege attack is shown.