Kernel Mitigation Policies for Fleet Cyberattack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Managing security vulnerabilities in complex software systems is complex due to the large number of CVEs, requiring manual efforts to maintain security across a fleet of IT equipment, and existing methods do not efficiently detect and mitigate attacks at the kernel level without restarting the system.
Innovation Solution
A method and module for detecting and mitigating attacks at the kernel level by executing mitigation policies within a kernel namespace, sending attack data to a security management server, and automatically installing mitigation policies across a network without manual intervention, using a mitigation policy program loaded into the kernel namespace associated with processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual security management methods are used to track and mitigate CVEs across a fleet of computers, then security coverage can be maintained, but the complexity and time required for security management increases significantly
Solution Approach 1:
The system enables computers to automatically detect and report their own security state by executing mitigation policies and sending messages to the security management server, eliminating the need for manual security checks and reducing management complexity while maintaining comprehensive security coverage
Solution Approach 2:
The security management system implements a feedback mechanism where computers automatically report security events and vulnerability states to the central server, which then distributes updated mitigation policies, creating a closed-loop system that continuously improves security without manual intervention
2Reliability
If traditional security mitigation methods are implemented, then vulnerability exploitation can be blocked, but system restart is required which causes downtime
Solution Approach 1:
Mitigation policies are pre-loaded into kernel namespaces associated with processes before attacks occur, allowing the system to have security measures ready and applied without requiring restart when vulnerabilities need to be mitigated
Solution Approach 2:
The system dynamically loads and applies mitigation policies to kernel namespaces without system restart, allowing security measures to be activated on-demand based on detected attack vectors while maintaining continuous system operation
3Adaptability or versatility
If centralized security management is implemented across a fleet of computers, then security consistency can be maintained, but network communication overhead increases
Solution Approach 1:
The security management system is segmented into autonomous components where each computer independently executes mitigation policies and reports security events, reducing continuous network communication overhead while maintaining centralized policy distribution and consistency across the fleet
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A method for detecting an attempted cyber attack, said method being implemented by a computer (EQn), said attack exploiting a vulnerability (CVEk) in a function to be protected (fc1) running in a process (p1) of a user space (USRn) of said computer (EQn), launching of the execution of said function to be protected (fc1) resulting in the execution, before said attack, of a function of the kernel (oper_exec), said method comprising steps of: - executing (F_Ex) a mitigation policy (PGk) in said kernel (KERn), said mitigation policy (PGk) being associated with said function of the kernel (oper_exec) and being loaded into a namespace (ENSECURE1) of the kernel associated with said process (p1) and dedicated to security; - sending (F_E), to a security management server (CNode), a message (Logi) comprising a datum representative of said process (p1).