Executable File Lockdown via Hash Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting executable software programs from viruses are inefficient, particularly in larger or shared servers, as they involve time-consuming lockdown processes and may not ensure complete removal of virus code without damaging the program, and lack effective monitoring of executable file behavior.
Innovation Solution
A method that involves flagging and preventing the execution of modified files by creating a signature and hash for meta data associated with executable files, initiating a lockdown mode to deny execution of new or modified files, and using a software module to intercept and monitor file system operations to enforce security policies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional virus protection methods are used to inventory and create signatures for all executable files, then virus protection is provided, but the lockdown process becomes time-consuming and inefficient
Solution Approach 1:
The system performs preliminary actions by creating and storing cryptographic hashes of all executable files during a lockdown event, then uses these pre-computed hashes for rapid comparison against known virus signatures. This preliminary hashing action eliminates the need for time-consuming real-time file analysis during virus detection.
Solution Approach 2:
The system creates a cryptographic copy (hash) of each executable file's contents and stores it in a database. Instead of analyzing the actual executable files during virus detection, the system compares the stored hash copies against virus databases, dramatically reducing the time required for virus scanning while maintaining detection accuracy.
2Ease of repair
If virus code is removed from infected programs, then the program is restored, but the program may be damaged and complete removal cannot be ensured
Solution Approach 1:
The system creates and stores a cryptographic hash of the original, uninfected executable file before any virus infection occurs. This preliminary hash serves as a trusted reference that can be used to verify whether the file has been compromised and to guide the restoration process by comparing against the known good state.
Solution Approach 2:
The system extracts and stores the cryptographic hash (a distilled representation) of the executable file's contents separately from the file itself. This extracted hash can be used to verify file integrity and detect infections without modifying or potentially damaging the original executable file during the restoration process.
3Reliability
If real-time monitoring of executable file behavior is implemented, then security is improved, but system complexity increases
Solution Approach 1:
The system introduces a file system filter driver as an intermediary layer between the executable files and the operating system. This filter driver intercepts file system calls and monitors executable file behavior in real-time without requiring complex modifications to the files themselves or the core operating system, simplifying the overall monitoring architecture.
Solution Approach 2:
The system replaces complex behavioral analysis mechanisms with a simpler hash-based verification mechanism. Instead of analyzing the actual execution behavior and code patterns of executables, the system uses cryptographic hash comparison to detect infections, significantly reducing the complexity of the monitoring system while maintaining high security effectiveness.
Data Source
AI summary
A system and method that trusts software executables existent on a machine prior to activation for different types of accesses e.g. execution, network, and registry. The system detects new executables added to the machine as well as previously existent executables that have been modified, moved, renamed or deleted. In certain embodiments, the system will tag the file with a flag as modified or newly added. Once tagged, the system intercepts particular types of file accesses for execution, network or registry. The system determines if the file performing the access is flagged and may apply one or more policies based on the requested access. In certain embodiments, the system intercepts I/O operations by file systems or file system volumes and flags metadata associated with the file. For example, the NT File System and its extended attributes and alternate streams may be utilized to implement the system.