Kernel Process Monitoring for Fileless Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity solutions are inadequate in detecting and remediating fileless malware and malicious code, such as shellcode and reverse shells, which can evade detection through operating system kernels and pose significant threats to computer networks.
Innovation Solution
A cybersecurity solution that monitors computing resource processes on an operating system kernel, determines process parameters, and compares them to a whitelist to identify unauthorized processes, generating notifications and remediating threats by terminating or isolating suspicious processes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing cybersecurity solutions are used, then system simplicity is maintained, but detection capability against fileless malware is insufficient
Solution Approach 1:
The cybersecurity solution is divided into distinct functional modules: a monitoring module that tracks process creation and execution, a whitelist management module that maintains authorized process lists, and a remediation module that isolates malicious processes. This segmentation enables precise detection of fileless malware through process parameter monitoring while maintaining system manageability through modular architecture.
Solution Approach 2:
The patent introduces a proxy server as an intermediary component between the network and communicating devices. The proxy server monitors network traffic and process connections, acting as a mediator that detects malicious activities without requiring direct modification of the operating system kernel, thus enhancing detection capability while preserving system stability.
2Measurement precision
If comprehensive process monitoring is implemented, then detection accuracy improves, but processing time increases
Solution Approach 1:
The system performs preliminary actions by maintaining a whitelist of authorized processes and pre-defining monitoring rules for process parameters. When a new process is created, the system immediately checks it against the whitelist and predefined rules, enabling rapid detection decisions without requiring extensive analysis of each process, thus maintaining high detection accuracy while minimizing processing time.
Solution Approach 2:
The patent monitors specific process parameters (such as process names, paths, and network connections) rather than analyzing entire process states. By focusing on critical parameters that indicate malicious behavior, the system achieves high detection accuracy while reducing the computational overhead and processing time required for monitoring.
3Reliability
If unauthorized processes are isolated, then network security is enhanced, but system productivity decreases
Solution Approach 1:
The system implements feedback mechanisms where isolated processes are monitored to determine if they are legitimate applications temporarily blocked or confirmed malicious processes. Based on this feedback, the system can restore legitimate processes while maintaining isolation of confirmed threats, thus enhancing network security while minimizing impact on system productivity.
Solution Approach 2:
The patent employs disposable isolation containers that are created temporarily to contain suspicious processes and then discarded after analysis or confirmation of malicious behavior. This approach enhances security by isolating threats while minimizing productivity loss, as the isolation infrastructure is lightweight and processes can be quickly restored if determined to be legitimate.
Data Source
AI summary
A cybersecurity solution that includes a system, method, or computer program for detecting and remediating malicious code in a communicating device on a computer network that connects to the Internet through a proxy server. The solution includes an operating system arranged to monitor all computing resource (CR) processes on an operating system kernel on the communicating device, determine process parameters for each CR process, determine whether each CR process is a connecting CR process by determining whether it is connecting to the proxy server, compare at least one of the process parameters for each connecting CR process with a whitelist, generate an event notification when at least one process parameter for a connecting CR process does not match the whitelist, and remediate the connecting CR process that has the at least one process parameter.