Malicious Code Detection via Stack Trace Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to effectively detect and prevent malicious network connections initiated by malicious code, which can lead to unauthorized data theft and other malicious activities, especially in advanced targeted attacks targeting high-value information sectors.
Innovation Solution
A computer-implemented method and system that detects connection establishment processes initiated by code on a client terminal, analyzes stack traces and related data to identify malicious communication attempts, and blocks the network connection to prevent malicious activity, utilizing a gateway to monitor and analyze flow-data including thread, module, and process data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional malicious code detection systems are used, then general security monitoring is provided, but they fail to detect advanced targeted attacks that steal data through malicious network connections
Solution Approach 1:
The system performs preliminary analysis of stack traces during the connection establishment process, before the malicious communication is fully initiated. By detecting suspicious patterns in the call stack during TCP connection setup, the system can identify and block malicious code attempts before they successfully transmit stolen data, thus achieving early prevention of advanced targeted attacks
Solution Approach 2:
The system introduces stack trace analysis as an intermediary detection mechanism between the malicious code and the network connection. By examining the call stack information during connection establishment, the system creates an intermediate layer of inspection that reveals the presence of malicious code without directly intercepting the malicious communication itself
2Object-affected harmful factors
If network connections are monitored and blocked, then malicious communication is prevented, but legitimate connections may be falsely identified and blocked
Solution Approach 1:
The system applies different analysis criteria to different parts of the connection establishment process. By examining specific segments of the stack trace and comparing them against known malicious patterns, the system can locally identify suspicious characteristics without affecting the overall legitimacy of normal connections. This localized analysis approach reduces false positives while maintaining detection effectiveness
3Measurement precision
If detailed stack trace analysis is performed, then malicious code detection accuracy is improved, but system complexity and processing overhead increase
Solution Approach 1:
The system extracts only the critical and relevant portions of the stack trace information needed for malicious code detection, rather than analyzing the entire call stack in detail. By focusing on specific function calls and code patterns that are indicative of malicious behavior during connection establishment, the system reduces processing complexity while maintaining high detection accuracy
Data Source
Figure 1A
Figure 1B
Figure 2
AI summary
There is provided a computer implemented method for detection and prevention of an attempt at establishment of a network connection for malicious communication, comprising: detecting a connection establishment process for establishing a network connection, the connection establishment process initiated by code running on a client terminal; analyzing records in at least one stack trace of the initiating code managed at the client terminal, to detect a trial to establish a malicious communication wherein the network connection is used for malicious activity; and blocking establishment of the network connection when the analysis detects the trial to establish the malicious communication based on the network connection.