File Metadata Repository for Known-Deployed Artifact Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity detection systems struggle to differentiate between benign and malicious artifacts on host endpoints, particularly when attackers use 'Living off the Land Binaries and Scripts' (LOLBAS), as existing methods rely on static or infrequently updated reference sets that do not account for environment-specific artifacts and their deployment status.
Innovation Solution
A known-deployed file metadata repository (KDFMR) and analysis engine that maintains a database of centrally deployed artifacts, analyzes files for metadata, and uses sandbox detonation to identify and categorize files as 'known-deployed' or potentially malicious, providing a dynamic and environment-specific analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If hash-based approaches are used to identify files, then file identification is simplified, but the ability to differentiate between benign and malicious artifacts is reduced
Solution Approach 1:
The patent segments the file identification process into multiple components: hash-based quick matching for efficiency, metadata analysis for context, and behavioral analysis through sandbox detonation for malicious intent detection. This multi-layered segmentation allows the system to maintain operational simplicity while achieving high precision in artifact differentiation.
Solution Approach 2:
The patent introduces an intermediary metadata repository that stores contextual information about files beyond simple hashes. This metadata layer acts as a mediator between simple hash matching and complex behavioral analysis, providing additional context about file origins, relationships, and expected behaviors to improve differentiation accuracy without sacrificing operational efficiency.
2Reliability
If comprehensive file analysis is performed to improve detection accuracy, then security detection capability is enhanced, but processing time and system resources increase
Solution Approach 1:
The patent performs preliminary actions by pre-calculating and storing metadata about files in the metadata repository before security analysis is needed. This includes storing information about file origins, expected behaviors, and relationships. When security analysis is required, this pre-computed metadata is immediately available, reducing processing time while maintaining comprehensive analysis capabilities.
Solution Approach 2:
The patent implements a tiered analysis approach where not all files receive the full extent of analysis. Files are analyzed to varying degrees based on risk indicators, file type, and contextual metadata. This partial action approach maintains high detection capability for suspicious files while reducing processing time for benign files, optimizing the balance between reliability and time loss.
3Measurement precision
If centralized file deployment tracking is implemented, then identification of approved files is improved, but system complexity increases
Solution Approach 1:
The patent makes the metadata repository and analysis engine universal components that serve multiple functions: tracking centralized deployments, analyzing security threats, and providing contextual information for artifact differentiation. This multi-functionality reduces overall system complexity by consolidating what could be separate specialized systems into a single versatile platform.
Solution Approach 2:
The system implements self-service mechanisms where the metadata repository automatically updates itself as files are deployed and modified in the centralized system. The analysis engine automatically queries the repository and updates its understanding of approved files without requiring manual configuration or intervention. This self-service capability reduces operational complexity while maintaining precise tracking of approved files.
Data Source
AI summary
A known-deployed file metadata repository (KDFMR) and analysis engine enumerates reference lists of files stored on a software delivery point (SDP) and compares the enumerated list of files and associated metadata to previously stored values in the KDFMR. If newly stored or modified files are identified, the analysis engine acquires the files from the SDP. Each file is analyzed to determine whether the file is an atomic file or a container file and metadata is generated or extracted. Each file stored in a container file is recursively extracted and analyzed, where metadata is generated for each extracted file and each container file. The KDFMR periodically analyzes the files stored on the SDP for differences to maintain the currency of the KDFMR data with respect to files stored on the SDP. Storage or modification of files on the SDP triggers analysis of the associated file. KDFMR data is updated with metadata determined based on sandbox detonation of files and/or identified artifacts of known-deployed files.