Function Interposition for Cluster Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security solutions for computing environments, such as HPC clusters, are susceptible to dynamic insertion of malicious code between applications and dynamic libraries, which can intercept API calls without detection, posing a risk to sensitive operations like nuclear simulations and aerospace operations.
Innovation Solution
The implementation of function interposition to capture and compare phase data related to library calls, such as MPI calls, threading calls, and memory allocation/deallocation, to identify anomalies in runtime behavioral patterns, triggering security events when deviations are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional host-based intrusion detection systems (HIDS) and network-based intrusion detection systems (NIDS) are used to monitor security, then security monitoring capability is provided, but the systems remain susceptible to dynamic insertion of malicious code between applications and dynamic libraries
Solution Approach 1:
The patent applies preliminary action by pre-establishing a baseline behavioral profile of legitimate library calls before malicious code can be inserted. The system captures and stores normal calling patterns, sequences, and parameters of dynamic library functions during a training phase. When runtime occurs, any deviation from this pre-established baseline triggers anomaly detection, preventing malicious code from operating undetected even if dynamically inserted.
Solution Approach 2:
The system implements feedback by continuously monitoring library call behavior and comparing it against the established baseline, then using this feedback to detect anomalies. When unusual calling patterns are detected, the system generates security events that can trigger responses such as blocking execution or alerting administrators. This closed-loop feedback mechanism enables real-time detection and response to malicious code insertion attempts.
2Measurement precision
If function interposition is implemented to capture phase data for anomaly detection, then detection capability against malicious code is improved, but system intrusion and complexity increase
Solution Approach 1:
The patent uses an intermediary approach by introducing a profiling layer that sits between the application and the dynamic libraries. This intermediary component captures library call information without requiring modification of the original application or libraries. The profiler acts as a mediator that records calling patterns and passes control back to the original execution flow, minimizing intrusion while enabling comprehensive monitoring of library interactions.
Solution Approach 2:
The system applies copying by creating a replicated model of normal library call behavior during the profiling phase. Instead of directly analyzing every runtime call against complex rules, the system copies the established baseline patterns and compares incoming calls against these replicated models. This copying approach simplifies real-time detection while maintaining high precision in identifying deviations from normal behavior.
3Reliability
If comprehensive monitoring of library calls is performed to detect security breaches, then security coverage is enhanced, but performance overhead increases
Solution Approach 1:
The patent applies partial action by focusing monitoring efforts on the most critical and informative aspects of library call behavior rather than attempting to analyze every single call in exhaustive detail. The system identifies and monitors key parameters such as calling sequences, function types, and abnormal patterns that are most indicative of malicious activity. This selective monitoring approach provides sufficient security coverage while minimizing the performance overhead associated with comprehensive analysis of all call parameters.
Data Source
AI summary
Systems and methods may provide for identifying a runtime behavioral pattern of an application and detecting an anomaly in the runtime behavioral pattern. In addition, a security event may be triggered in response to the anomaly. In one example, the anomaly is detected with regard to one or more of a library call count, a library call type, a library call argument configuration or a library call timing associated with a runtime operation of the application.