Generic Object Hooking for Malformed Argument Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current detection systems for malware attacks, such as script attacks using malformed arguments, require explicit hooking of specific object/function combinations and prior knowledge of attacks, making them inefficient and prone to missing new threats.
Innovation Solution
A method to detect malformed arguments by hooking a generic object, monitoring for predetermined patterns like NOP sleds and shellcode across all function calls, and reporting matches to a virtual method table for identification and reporting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If explicit hooking of specific object/function combinations is used for detection, then detection accuracy for known attacks is improved, but device complexity and difficulty of detecting new threats increases
Solution Approach 1:
The patent applies universality by hooking a generic object (IDispatch interface) that can detect multiple types of attacks across different object/function combinations. Instead of creating separate detection mechanisms for each specific function, the system uses a single generic hooking mechanism that monitors all function calls through the common IDispatch interface, thereby reducing complexity while maintaining broad detection capability.
Solution Approach 2:
The IDispatch interface serves as an intermediary between the malware detection system and various object/function combinations. By monitoring arguments passed through this universal intermediary interface, the system can detect malicious patterns (NOP sleds, shellcode) without needing direct access to or modification of each specific function's implementation details, simplifying the detection architecture.
2Reliability
If prior knowledge of specific object/function combinations is required, then detection reliability for known attacks is improved, but adaptability to new attacks deteriorates
Solution Approach 1:
The system performs preliminary action by establishing a generic detection framework in advance that monitors all function calls through the IDispatch interface. This preliminary setup allows the system to detect both known attacks (by checking for predetermined patterns like NOP sleds) and new attacks (by monitoring for any malformed arguments) without requiring prior knowledge of specific attack vectors or function combinations.
Solution Approach 2:
The patent employs parameter changes by monitoring argument values and their characteristics rather than relying on fixed knowledge of specific function signatures. The system checks for predetermined patterns (such as NOP sled sequences) within arguments and can adapt to new attack patterns by detecting deviations from normal argument structures, thereby improving adaptability while maintaining reliability through pattern recognition.
3Adaptability or versatility
If monitoring of all function calls is implemented, then coverage of malicious patterns is improved, but processing time and system performance deteriorates
Solution Approach 1:
The patent applies local quality by focusing monitoring attention on specific critical areas within function calls rather than uniformly analyzing all parameters. The system specifically monitors argument values for predetermined malicious patterns (NOP sleds, shellcode) and only performs detailed analysis when anomalies are detected, thereby maintaining comprehensive coverage while reducing unnecessary processing time on benign function calls.
Data Source
AI summary
A computer-implemented method to detect malformed arguments in a function by hooking a generic object, is described. A predetermined argument to monitor is identified. An activity associated with a calling of a function to produce a called out function is detected. The called out function is mapped to a class identification of an object. An argument in the called out function is compared with the predetermined argument. When a match exists, a virtual method table identification is recorded for the called out function. The match between the argument in the called out function and the predetermined argument is reported.