Layering System Isolating Zero-Day Attacks via Write Layer
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security solutions are ineffective in isolating and evaluating unknown security threats, such as zero-day attacks, which can harm computing systems by modifying resources across different layers.
Innovation Solution
A layering system that mounts frozen and write layers, using layering drivers to redirect I/O requests to isolate changes within a write layer, allowing for evaluation of potential malware without affecting other layers, and providing a security solution that appears transparent to the user.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional antivirus solutions are used to detect security threats, then known malware can be identified, but zero-day attacks and unknown threats cannot be detected
Solution Approach 1:
The system segments the file system into multiple independent layers (frozen layers and write layers). Each layer can be independently mounted and managed, allowing security evaluation of specific layers without affecting others. This segmentation enables isolation of potentially malicious files in write layers while preserving intact frozen layers, thereby improving detection of unknown threats without compromising system stability.
Solution Approach 2:
The layering system acts as an intermediary between the user's computing device and the underlying file system. By introducing this intermediate layering mechanism, the system can intercept and redirect I/O operations, allowing security evaluation of files before they execute or modify system resources. This intermediary approach enables detection and containment of zero-day attacks before they can harm the system.
2Reliability
If security evaluation is performed on files before execution, then potential threats can be detected, but the evaluation process may affect system performance
Solution Approach 1:
The system performs preliminary security evaluation by mounting files in a write layer before they are executed or allow modifications to frozen layers. This preliminary action isolates potentially malicious files in a controlled environment where they can be evaluated without immediately impacting system performance or integrity. The layering mechanism allows batch evaluation and controlled activation, reducing performance overhead.
Solution Approach 2:
The layering system creates a copy of the file system structure in the form of write layers that can be mounted independently. Instead of evaluating files in their original locations, the system copies them into isolated write layers for security evaluation. This copying approach allows parallel evaluation of multiple files without blocking system operations, thereby maintaining productivity while improving security reliability.
3Object-affected harmful factors
If files are isolated in separate layers for security evaluation, then threats can be contained, but user accessibility to files may be reduced
Solution Approach 1:
The layering driver acts as an intermediary that transparently manages access to files across different layers. Users interact with files through the unified namespace provided by the layering system, which automatically routes access requests to the appropriate layers. This intermediary mechanism maintains ease of operation by presenting a consistent file access interface while internally enforcing security isolation through layer management.
Solution Approach 2:
The system merges multiple layers (frozen and write layers) into a unified virtual file system namespace. From the user's perspective, files from different layers appear as a single integrated file system, maintaining ease of access and operation. The layering driver automatically manages the complexity of multi-layer access, allowing users to work with files normally while the system internally enforces security boundaries and isolation between layers.
Data Source
AI summary
A security solution can be implemented using a layering system. By using a layering system, any changes that are made to a computing system can be isolated within a separate write layer. Due to this isolation, the changes, which may even be malicious, can be evaluated without fear that the resources in other layers will be negatively affected. In this way, even security threats that are still unknown to antivirus solutions (so-called zero-day attacks) can be prevented from harming the system.