Known-Deployed File Metadata Analysis for Precise Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity detection systems struggle to differentiate between benign and malicious artifacts on host endpoints, particularly when attackers use 'Living off the Land Binaries and Scripts' (LOLBAS), as existing methods rely on static or infrequently updated reference sets that do not account for environment-specific approved files.
Innovation Solution
A known-deployed file metadata repository (KDFMR) and analysis engine that maintains a database of approved files from software distribution points, analyzes newly stored or modified files, and uses sandbox detonation to identify and categorize files as 'known-good' or 'known-bad', minimizing false positives by leveraging environment-specific metadata.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Device complexity
If static or infrequently updated reference sets are used for file analysis, then system complexity is reduced, but measurement precision and reliability of malicious artifact detection deteriorate
Solution Approach 1:
The patent implements dynamic updating of the known-deployed file metadata repository through automated processes that periodically acquire files from software distribution points, analyze them in sandbox environments, and update the repository with newly approved files. This dynamic approach ensures the reference set remains current without requiring manual intervention, resolving the contradiction between system complexity and detection precision.
Solution Approach 2:
The system performs self-service through automated sandbox detonation and analysis processes that autonomously identify and categorize files as known-good or known-bad. The analysis engine automatically updates the KDFMR without external intervention, maintaining high detection precision while minimizing the operational complexity burden on users.
2Measurement precision
If environment-specific metadata is incorporated into the reference set, then detection precision improves, but device complexity and data management burden increase
Solution Approach 1:
The patent creates environment-specific metadata repositories tailored to each enterprise's software distribution points and approved files. Rather than using a generic reference set, the system builds customized KDFMR instances that reflect the specific environment's approved files, improving detection precision while managing complexity through automated local repository management.
Solution Approach 2:
The analysis engine acts as an intermediary that automatically manages the complexity of environment-specific metadata by interfacing with software distribution points, performing sandbox analysis, and maintaining the KDFMR. This intermediary handles the data management burden, allowing the system to leverage environment-specific metadata for improved precision without directly exposing the complexity to users.
3Reliability
If comprehensive file analysis and sandbox detonation are performed for all new files, then reliability of file categorization improves, but productivity and processing speed decrease
Solution Approach 1:
The system applies partial analysis by performing sandbox detonation and comprehensive analysis only on files that are newly stored or modified in the software distribution point, rather than re-analyzing all files continuously. This selective approach maintains high reliability for categorization decisions while improving overall processing speed by avoiding redundant analysis of unchanged files.
Solution Approach 2:
The analysis engine implements periodic monitoring and analysis cycles, checking for new or modified files at scheduled intervals and performing sandbox detonation only when changes are detected. This periodic action maintains reliable file categorization while optimizing processing efficiency by avoiding continuous analysis of static file sets.
Data Source
AI summary
A known-deployed file metadata repository (KDFMR) and analysis engine enumerates reference lists of files stored on a software delivery point (SDP) and compares the enumerated list of files and associated metadata to previously stored values in the KDFMR. If newly stored or modified files are identified, the analysis engine acquires the files from the SDP. Each file is analyzed to determine whether the file is an atomic file or a container file and metadata is generated or extracted. Each file stored in a container file is recursively extracted and analyzed, where metadata is generated for each extracted file and each container file. The KDFMR periodically analyzes the files stored on the SDP for differences to maintain the currency of the KDFMR data with respect to files stored on the SDP. Storage or modification of files on the SDP triggers analysis of the associated file. KDFMR data is updated with metadata determined based on sandbox detonation of files and/or identified artifacts of known-deployed files.