Indirect Interface Monitoring via Call Stack Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information system security technologies face challenges in effectively monitoring and protecting against malware, particularly in environments where direct monitoring is restricted or evaded by malicious software, such as 64-bit Windows systems with PatchGuard, and struggle to track system usage beyond what is natively supported by the host environment.
Innovation Solution
The implementation of indirect interface monitoring and plumb-lining through a security monitor that uses call frame analysis and stack walking to identify and track the execution of upper-level interfaces, even when lower-level operations are invoked directly, allowing for comprehensive systems monitoring and detection of malware evasion techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If direct monitoring of lower-level interfaces is implemented, then security monitoring capability is improved, but malware can evade detection by invoking lower-level interfaces directly without going through upper-level interfaces
Solution Approach 1:
The patent divides monitoring into two layers: upper-level interface monitoring (user-mode APIs) and lower-level interface monitoring (kernel-mode interfaces). By segmenting the monitoring scope and using indirect monitoring where upper-level interfaces call lower-level interfaces, the system achieves comprehensive coverage while preventing malware evasion techniques.
Solution Approach 2:
The patent implements nested monitoring where upper-level interface monitoring is embedded within the context of lower-level interface monitoring. The system tracks call stacks to correlate upper-level API calls with their corresponding lower-level interface invocations, creating a nested monitoring structure that prevents evasion.
2Reliability
If indirect interface monitoring is implemented to detect evasion, then security detection capability is improved, but system complexity increases due to call stack analysis requirements
Solution Approach 1:
The patent introduces an intermediary component (the security monitor) that acts as a mediator between upper-level interface monitoring and lower-level interface monitoring. This intermediary correlates call stack information and determines whether lower-level interfaces are being evaded, simplifying the overall system architecture while maintaining detection capability.
Solution Approach 2:
The system implements feedback mechanisms where the security monitor continuously analyzes call stack information and provides feedback on detected evasion attempts. This feedback loop enables the system to adapt and improve detection accuracy while managing complexity through iterative refinement.
3Loss of information
If comprehensive system monitoring is implemented, then information collection about system usage is improved, but host system stability may be compromised due to extensive monitoring operations
Solution Approach 1:
The patent implements partial monitoring by focusing only on specific interface invocations and call stack analyses that are relevant to detecting evasion. Rather than monitoring all system operations, the system selectively monitors upper-level interfaces and correlates them with lower-level interfaces, reducing the burden on the host system while maintaining effective detection.
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
A method is provided in one example embodiment that includes monitoring a first interface, monitoring a second interface, and taking a policy action if the second interface is not executed before the first interface. In more particular embodiments, monitoring the second interface may include walking a call stack associated with the first interface. Moreover, a program context for calling code associated with the second interface may be identified and acted upon.