Malicious Process Protection via Falsified OS Information
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malicious code injection poses a significant cybersecurity threat as existing technologies fail to effectively protect computing devices from shellcode execution, allowing attackers to exploit vulnerabilities in operating systems and applications.
Innovation Solution
The method involves providing a malicious process with falsified information about the operating system or computing device, causing injected shellcode to fail due to incompatibility, and includes hooking procedure calls to intercept and alter queries, thereby preventing successful execution of malicious code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security measures are used to protect against malicious code injection, then device security is maintained, but attackers can still exploit vulnerabilities and execute shellcode
Solution Approach 1:
The system dynamically changes the parameters of system information (OS version, device type, application version) by providing falsified data to malicious processes. This parameter alteration prevents shellcode execution by ensuring the injected code is incompatible with the reported system configuration, thereby maintaining device security while blocking attacks.
Solution Approach 2:
The patent introduces an intermediary component that sits between the malicious process and the actual system information. This intermediary provides falsified system information to the malicious process, preventing the shellcode from obtaining accurate system details needed for successful execution, thus protecting the device without requiring direct intervention in the attack chain.
2Adaptability or versatility
If system information is provided accurately to processes, then system compatibility is maintained, but malicious processes can exploit this information for code injection
Solution Approach 1:
The system applies different information quality to different processes. For legitimate processes, accurate system information is provided to maintain compatibility. For suspicious or malicious processes, falsified information is provided to prevent exploitation. This local differentiation allows the system to maintain adaptability for legitimate use while blocking vulnerability exploitation.
Solution Approach 2:
The system dynamically changes the parameter values of system information based on the requesting process. Legitimate processes receive accurate parameters ensuring compatibility, while malicious processes receive altered parameters that prevent successful shellcode execution, thus resolving the contradiction between compatibility and security.
3Ease of operation
If shellcode execution is allowed to proceed, then process functionality is maintained, but malicious code can compromise the system
Solution Approach 1:
The system performs preliminary anti-action by providing falsified system information to malicious processes before shellcode execution can occur. This preemptive measure ensures that when the shellcode attempts to execute with the incorrect system parameters, it fails automatically, protecting system integrity while allowing legitimate processes to execute normally.
Solution Approach 2:
The patent converts the harmful effect of information disclosure into a beneficial security mechanism. By providing falsified system information to malicious processes, the system turns what would be a vulnerability (information leakage) into a protective measure that causes shellcode execution to fail, thus maintaining system integrity.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Various automated techniques are described herein for protecting computing devices from malicious code injection and execution by providing a malicious process with incorrect information regarding the type and/or version and/or other characteristics of the operating system and/or the targeted program and/or the targeted computing device. The falsified information tricks the malicious process into injecting shellcode that is incompatible with the targeted operating system, program and/or computing device. When the incompatible, injected shellcode attempts to execute, it fails as a result of the incompatibility, thereby protecting the computing device.