Firewall Authorization for Trojan DLL Communication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing firewalls are inadequate in preventing Trojan DLLs from communicating by leveraging authorized application programs, as they can bypass detection through various methods, including loading into the address space of authorized applications, spoofing, or using allowed protocols and channels, making it difficult to identify and block unauthorized communication.
Innovation Solution
A system and method that identify program modules using CPU call history and perform authorization tests to intercept and validate functions, ensuring only authorized program modules can communicate, thereby preventing unauthorized modules from transmitting data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional firewalls block unauthorized application programs, then Trojan EXEs are blocked, but Trojan DLLs can still bypass the firewall by leveraging authorized application programs
Solution Approach 1:
The invention segments the authorization check process into two levels: first checking if the parent application program is authorized, then checking if the specific DLL module is authorized. This segmentation allows the firewall to maintain blocking capability while preventing Trojan DLL bypasses through hierarchical authorization validation.
Solution Approach 2:
The invention introduces a call history data structure as an intermediary mechanism to track and record the execution context of authorized application programs. This intermediary allows the firewall to monitor which DLLs are loaded by authorized applications and verify their authorization status, preventing Trojan DLLs from leveraging authorized applications without detection.
2Reliability
If firewalls limit communication to specific protocols and channels, then some Trojan communication is blocked, but Trojans can still communicate using allowed protocols and channels
Solution Approach 1:
The invention performs preliminary authorization checks on DLL modules before they can communicate. By validating the authorization status of each DLL in the call history before allowing communication, the system prevents Trojans from using allowed protocols and channels, as unauthorized DLLs are blocked at the authorization stage rather than at the communication stage.
3Reliability
If firewalls protect program modules from overwriting, then some Trojan prevention is achieved, but it is difficult to identify which modules belong to authorized applications
Solution Approach 1:
The invention implements a feedback mechanism through the call history data structure that continuously tracks which DLLs are loaded by authorized application programs. This feedback loop allows the firewall to learn and remember the authorized module relationships, making it easier to identify and protect authorized modules from overwriting by Trojans.
4Reliability
If firewalls require re-authorization of application programs, then some Trojan DLL protection is achieved, but user intervention is required and many applications routinely modify registrations
Solution Approach 1:
The invention enables the firewall to perform self-service authorization management by automatically tracking and validating DLL module authorization status through the call history mechanism. The system automatically determines which modules need re-authorization based on their usage patterns and communication attempts, eliminating the need for manual user intervention while maintaining robust Trojan protection.
Data Source
AI summary
A system, method and computer program product are provided for preventing unauthorized program modules from communicating. Initially, at least one program module is identified utilizing a central processing unit call history. Thereafter, an authorization test is performed on the at least one program module for preventing unauthorized program modules from communicating.