Automated Interpreted Application Control for File-Less Attacks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods and tools are inadequate in identifying and protecting against sophisticated script-based cyber-attacks that exploit vulnerabilities in computing workloads, particularly in cloud-native and legacy applications, as file reputation engines are ineffective against file-less malware.
Innovation Solution
Implementing an Automatic Interpreted Application Control Policy (IACP) that automatically generates and enforces rules to protect workloads by checking user permissions, interpreter and script identifiers, and parameter compliance, and intercepts processes and libraries to prevent unauthorized execution and vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If file reputation engines are used to protect workloads, then existing security measures are simplified, but they become ineffective against file-less malware and sophisticated script-based attacks
Solution Approach 1:
The patent replaces traditional file-reputation-based mechanical security systems with an automated interpreted application control system that uses policy-based decision-making. The system substitutes file signature matching with interpreter-level policy evaluation, enabling protection against file-less malware through command-line argument analysis and interpreter behavior monitoring rather than relying on static file reputations.
Solution Approach 2:
The system changes the protection parameters from file-based attributes (signatures, hashes) to interpreter and command-level attributes (policy compliance, parameter validation, process behavior). By shifting the control parameter from what file is executed to how it is executed and by whom, the system effectively addresses file-less malware threats while maintaining operational simplicity through automated policy enforcement.
2Reliability
If automated interpreted application control policies are implemented, then protection against script-based attacks is improved, but system complexity increases
Solution Approach 1:
The control system is segmented into distinct functional modules: policy definition layer, policy evaluation layer, and enforcement layer. Policies are separated from the interpreter implementation, allowing independent development and maintenance. This segmentation reduces overall system complexity by enabling modular updates to control logic without affecting the core interpreter functionality.
Solution Approach 2:
The system implements self-service through automated policy enforcement where the interpreter automatically checks commands against defined policies without requiring manual intervention. The control mechanism serves itself by automatically detecting policy violations and blocking executions, eliminating the need for complex manual security management while maintaining high protection levels.
3Reliability
If strict permission checks and approved interpreter lists are enforced, then security against unauthorized execution is improved, but operational flexibility is reduced
Solution Approach 1:
The system implements dynamic policy enforcement that adapts to different execution contexts. Policies can be dynamically adjusted based on user identity, command parameters, and execution environment. This dynamic approach allows the system to maintain strict security for unauthorized executions while providing operational flexibility for approved scenarios, as policies can be modified in real-time without system reconfiguration.
Solution Approach 2:
The control system applies local quality by implementing differentiated permission checks at specific points in the execution pipeline. Rather than a uniform block-all approach, the system allows localized flexibility where policies permit specific interpreters or commands under defined conditions. This enables authorized operations to proceed while blocking unauthorized executions, balancing security with operational needs.
Data Source
AI summary
Embodiments provide functionality to protect computing workloads from script-based attacks. Upon receipt, at a workload, of a command to commence execution of code of a script, an embodiment determines whether (i) permissions of a user issuing the command comply with a permissions security standard, (ii) an identifier of an interpreter supporting the script is included in an approved interpreter list, (iii) an identifier of a selected parameter of the interpreter is included in an approved parameter list, and (iv) an identifier of the script is included in an approved list of executables. If all of the aforementioned checks pass, such an embodiment allows execution of the code of the script; otherwise, execution is denied, thereby protecting the workload in an event of a script-based attack.