Known-Deployed File Metadata Repository for Endpoint Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity detection and response processes face challenges in differentiating between benign and malicious artifacts on a host endpoint, particularly in identifying artifacts introduced by adversaries or insiders, as existing methods rely on cryptographic hashes that are not specific to the environment and may not be updated frequently enough to account for legitimate changes, leading to false positives and negatives.
Innovation Solution
A known-deployed file metadata repository (KDFMR) and analysis engine that compares enumerated lists of files and metadata from a software delivery point to previously stored values, analyzes files to determine if they are atomic or container files, and updates metadata based on sandbox detonation, providing a consistent and scalable method to identify approved and centrally deployed artifacts while detecting potential adversary use.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If cryptographic hashes are used to identify artifacts, then file identification is simplified, but false positives and negatives increase due to lack of environment specificity and infrequent updates
Solution Approach 1:
The system changes the identification parameters from simple cryptographic hashes to comprehensive metadata attributes including file path, version information, digital signatures, and deployment source. This allows for environment-specific identification while maintaining automated processing, thereby improving detection accuracy without sacrificing identification simplicity.
Solution Approach 2:
The patent combines multiple identification elements (metadata attributes, cryptographic hashes, version information, digital signatures) into a composite identification system. This composite approach enables more reliable artifact identification by considering multiple factors simultaneously, reducing false positives and negatives while maintaining system automation.
2Reliability
If metadata repository is updated frequently to account for legitimate changes, then detection accuracy improves, but system complexity and resource consumption increase
Solution Approach 1:
The system performs preliminary actions by establishing a trusted metadata repository in advance containing information about legitimate artifacts. This pre-populated repository allows for efficient comparison and detection without requiring frequent updates, as the baseline data is prepared beforehand. The repository is updated only when legitimate changes are identified through authorized channels.
Solution Approach 2:
The metadata repository system implements self-service mechanisms through automated synchronization with software delivery points and configuration management databases. The system automatically detects, retrieves, and updates metadata for legitimate artifacts without requiring manual intervention, thereby maintaining high detection accuracy while minimizing operational complexity.
3Reliability
If all files on host endpoint are analyzed to differentiate benign from malicious, then detection completeness improves, but analysis time and computational resources increase
Solution Approach 1:
The system extracts and analyzes only the critical metadata attributes of files rather than performing comprehensive analysis of all file contents. By focusing on key identification elements such as digital signatures, version information, and deployment source, the system achieves sufficient detection completeness while dramatically reducing analysis time and computational resource requirements.
Solution Approach 2:
The patent applies partial action by analyzing only the necessary metadata portions of files rather than complete file contents. This selective approach provides sufficient information to differentiate benign from malicious artifacts while avoiding the time and resource costs of full file analysis. The system performs exactly the amount of analysis needed to achieve detection objectives.
4Measurement precision
If sandbox detonation is performed on all analyzed files, then metadata accuracy improves, but processing speed decreases
Solution Approach 1:
The system applies partial action by performing sandbox detonation only on a selective subset of files rather than all analyzed files. Specifically, sandbox detonation is applied to files with suspicious metadata attributes, unknown sources, or those flagged by preliminary analysis. This approach maintains high metadata accuracy for critical files while preserving overall processing speed by avoiding unnecessary detonation of obviously benign artifacts.
Data Source
AI summary
A known-deployed file metadata repository (KDFMR) and analysis engine enumerates reference lists of files stored on a software delivery point (SDP) and compares the enumerated list of files and associated metadata to previously stored values in the KDFMR. If newly stored or modified files are identified, the analysis engine acquires the files from the SDP. Each file is analyzed to determine whether the file is an atomic file or a container file and metadata is generated or extracted. Each file stored in a container file is recursively extracted and analyzed, where metadata is generated for each extracted file and each container file. The KDFMR periodically analyzes the files stored on the SDP for differences to maintain the currency of the KDFMR data with respect to files stored on the SDP. Storage or modification of files on the SDP triggers analysis of the associated file. KDFMR data is updated with metadata determined based on sandbox detonation of files and/or identified artifacts of known-deployed files.