Metadata-Based Floating Code Signature Generation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large enterprise computer networks face challenges in providing adequate security due to the strain on limited resources from processing security alerts and deploying remediation measures, especially with the continuous growth of diverse user devices and increasing malicious activity.
Innovation Solution
The generation and processing of metadata-based floating code signatures for endpoint devices to detect and remediate malicious activity, alleviating the burden on network security systems by utilizing metadata such as image hook and thread metadata to categorize potentially malicious code instances and initiate automated actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the network security system processes security alerts and deploys remediation measures for all user devices, then the security protection level is improved, but the system resources become strained
Solution Approach 1:
The patent segments the security monitoring task by introducing lightweight agents on endpoint devices that perform local floating code detection and metadata extraction. This distributes the security processing burden from the central network security system to individual endpoint devices, reducing the energy and computational resources required by the central system while maintaining comprehensive security coverage across all devices.
Solution Approach 2:
The endpoint agents autonomously perform security functions by detecting floating code instances, extracting their metadata, and generating signatures locally without requiring continuous central system intervention. This self-service capability allows each device to protect itself, reducing the overall resource demand on the network security system while maintaining high security protection levels.
2Reliability
If the network security system monitors and processes security alerts for a growing number of diverse user devices, then the security coverage is improved, but the processing capacity becomes insufficient
Solution Approach 1:
The patent divides the security processing workload by deploying distributed agents on each endpoint device. These agents independently perform floating code detection, metadata extraction, and signature generation, transforming a centralized processing bottleneck into a distributed parallel processing architecture that can scale to accommodate growing numbers of diverse devices without compromising processing capacity.
Solution Approach 2:
The patent transitions from a single-dimensional centralized processing model to a multi-dimensional distributed architecture where security processing occurs simultaneously at endpoint devices and the central system. This dimensional shift enables the system to handle expanding device diversity and volume by utilizing the computational resources across multiple dimensions rather than overloading a single central processing point.
3Measurement precision
If traditional security signature methods are used for file-based malware, then detection accuracy is maintained, but detection effectiveness fails against floating code instances
Solution Approach 1:
The patent fundamentally changes the detection parameters by shifting from file-based signatures to metadata-based signatures for floating code instances. Since floating code exists only in memory without file counterparts, the system extracts unique metadata characteristics (such as code structure, import tables, and behavioral patterns) to generate signatures, maintaining detection accuracy while adapting to the unique properties of memory-resident malware.
Solution Approach 2:
The patent creates a virtual representation or copy of the floating code's identifying characteristics through metadata extraction. Instead of requiring the actual code bytes (which change due to memory relocation), the system captures and analyzes metadata that replicates the essential identifying features of the floating code instance, enabling reliable detection and signature generation without direct access to the original code structure.
Data Source
AI summary
A method comprises detecting a plurality of floating code instances associated with one or more endpoint devices of a computer network, obtaining metadata of each of the floating code instances, and generating floating code signatures for respective ones of the floating code instances based at least in part on their respective metadata. The floating code signatures are utilized to categorize one or more of the floating code instances as at least potentially malicious floating code instances. A given one of the floating code instances illustratively comprises an executable code block dynamically allocated in a memory of a corresponding one of the endpoint devices and does not include any file structure counterpart. The metadata utilized to generate the floating code signature of a given one of the floating code instances illustratively comprises at least one of image hook metadata and thread metadata of the given floating code instance.