Interpreted Application Control for Script-Based Attack Blocking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods and tools are inadequate in identifying and preventing sophisticated script-based cyber-attacks that exploit vulnerabilities in computing workloads, particularly in cloud-native and legacy applications, as file reputation engines are ineffective against file-less malware.
Innovation Solution
Implementing an Automatic Interpreted Application Control Policy (IACP) that automatically generates and enforces rules to protect workloads by checking user permissions, interpreter and script identifiers, and parameter lists, and intercepting process spawns and library loads to prevent unauthorized execution of scripts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If file reputation engines are used to detect malware, then traditional file-based threats can be identified, but script-based attacks and file-less malware remain undetected
Solution Approach 1:
The patent changes the detection parameters from file-based characteristics to interpreter execution parameters. It monitors and controls how interpreters (like PowerShell, cmd.exe) are invoked with specific parameters, commands, and scripts. By tracking the parameters passed to interpreters and comparing them against approved lists, the system detects script-based attacks that traditional engines miss, while maintaining compatibility with legitimate operations.
2Reliability
If comprehensive security checks are implemented for script execution, then attack prevention improves, but system complexity increases
Solution Approach 1:
The patent introduces an intermediary layer between the interpreter and the executed script/commands. This intermediary component intercepts interpreter invocations, checks parameters against approved lists, validates user permissions, and either allows or blocks execution. This mediator approach provides comprehensive security without requiring complete system redesign, as it works within the existing operating system architecture.
Solution Approach 2:
The system performs preliminary validation checks before allowing script execution. It pre-establishes approved lists of interpreters, parameters, and user permissions. When an interpreter is invoked, the system checks whether the invocation matches approved patterns before allowing execution to proceed. This preliminary action prevents attacks before they can execute, rather than detecting them after the fact.
3Reliability
If interpreter execution is strictly controlled, then script-based attacks are blocked, but legitimate script operations may be hindered
Solution Approach 1:
The system pre-approves legitimate interpreter invocations by maintaining lists of approved interpreters, parameters, and user permissions. Legitimate operations that match approved patterns are allowed to execute without interruption. This preliminary approval mechanism ensures that normal business operations continue smoothly while blocking only unauthorized or malicious invocations.
Solution Approach 2:
The system provides feedback mechanisms that allow administrators to respond to blocked operations. When a script execution is blocked, the system can log the event and allow administrators to review and potentially add legitimate operations to the approved lists. This feedback loop ensures that the system adapts to legitimate needs while maintaining security, preventing false positives from disrupting operations.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Embodiments provide functionality to protect computing workloads from script-based attacks. Upon receipt, at a workload, of a command to commence execution of code of a script, an embodiment determines whether (i) permissions of a user issuing the command comply with a permissions security standard, (ii) an identifier of an interpreter supporting the script is included in an approved interpreter list, (iii) an identifier of a selected parameter of the interpreter is included in an approved parameter list, and (iv) an identifier of the script is included in an approved list of executables. If all of the aforementioned checks pass, such an embodiment allows execution of the code of the script; otherwise, execution is denied, thereby protecting the workload in an event of a script-based attack.