File Sequestration via Process Injection for Zero-Day Ransomware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-ransomware and antimalware technologies are ineffective against zero-day attacks and often fail to protect business assets from unauthorized access, as they rely on signature-based detection methods that miss emerging threats.
Innovation Solution
A file/folder sequestration system that protects individual files/folders at a granular level by monitoring process creation, injecting a sequestration library into processes, and suspending unauthorized access attempts, prompting users/administrators to confirm whether to allow or terminate the action.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection methods are used to block malware, then known threats can be identified and blocked, but zero-day threats and newly introduced malware cannot be detected
Solution Approach 1:
The patent segments the protection approach into two layers: (1) signature-based detection for known threats, and (2) behavior-based monitoring for unknown threats. The sequestration library is injected into individual processes to monitor their behavior, allowing the system to detect zero-day threats by analyzing actual process actions rather than relying solely on pre-defined signatures.
Solution Approach 2:
The system performs preliminary actions by injecting the sequestration library into processes before they can execute malicious actions. The library monitors process behavior in real-time, allowing the system to detect and respond to threats before they can complete their malicious objectives, rather than waiting for signature matches.
2Reliability
If traditional security programs block software based on signatures, then known malware can be stopped, but the programs cannot identify what running programs are actually doing
Solution Approach 1:
The sequestration library acts as an intermediary component injected into the target process. It mediates between the process and the operating system, monitoring process behavior without requiring direct access to the process's internal logic. The library captures process actions and communicates them to the security system, enabling behavior detection while maintaining process functionality.
Solution Approach 2:
The patent replaces traditional mechanical signature-matching approaches with a software-based behavior monitoring system. Instead of relying on static signature databases, the system uses dynamically injected libraries to observe and analyze actual process behavior, substituting mechanical pattern recognition with software-based behavioral analysis.
3Productivity
If malware successfully runs on a computer, then it can steal and encrypt data before being discovered, but the system lacks real-time monitoring capability
Solution Approach 1:
The sequestration library provides continuous monitoring of process behavior throughout its execution. Rather than performing periodic scans or relying on event-triggered detection, the library continuously observes process actions, ensuring that malicious behavior is detected immediately when it occurs, maintaining constant protection without interruption.
Solution Approach 2:
The system performs preliminary detection by monitoring process behavior before malicious actions can complete. The sequestration library detects suspicious patterns early in the process execution, allowing the system to respond before data theft or encryption can occur, rather than waiting for post-infection detection.
Data Source
AI summary
Systems and methods for providing sequestration of files and folders on a need-to-know basis based on the actions associated with file extensions and folder names by detecting whether a portable executable (PE) attempting to access a protected file or folder by use of a monitoring library is allowed to have access and taking appropriate action to allow or deny access.