Monitoring Service Detects Malicious Third-Party Software
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of third-party software packages in computing environments introduces security vulnerabilities due to the lack of comprehensive review, making them susceptible to unknown security threats and exploits, even when best security practices are employed.
Innovation Solution
Implementing a monitoring service that profiles the behavior of untrusted code during a learning period and compares it to expected behavior, a wrapping application that reduces privileges of untrusted code by executing it in a separate process with reduced privileges, and a risk profiling application that generates risk profiles based on security histories, including augmentation from similar packages with sufficient security history.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If third-party software packages are used to speed up software development, then productivity is improved, but security reliability deteriorates due to unknown vulnerabilities and malicious code
Solution Approach 1:
The system performs preliminary actions by monitoring and profiling the behavior of imported software packages during a learning period before they are fully deployed. A monitoring service records call stacks and privileged operations to establish a baseline of expected behavior, enabling early detection of malicious activities before they can cause significant harm.
Solution Approach 2:
A monitoring service acts as an intermediary between the imported software packages and the host system. This intermediary continuously observes the packages' behavior, compares it against established profiles, and can block suspicious operations, thereby mediating the security risk without preventing the use of third-party packages for productivity gains.
2Reliability
If comprehensive review of every imported package is performed to ensure security, then security reliability is improved, but device complexity and time consumption increase significantly
Solution Approach 1:
The system implements self-service by having the monitoring service automatically profile and evaluate imported software packages without requiring manual code review. The system autonomously establishes behavior profiles, monitors execution, and detects anomalies, eliminating the need for complex human review processes while maintaining high security reliability.
Solution Approach 2:
The patent replaces the mechanical process of manual code review with an automated electronic monitoring system. Instead of humans manually examining package code, a computing-based monitoring service automatically tracks runtime behavior, compares it against profiles, and detects security threats, significantly reducing both complexity and time requirements.
3Ease of operation
If blind trust is placed on imported packages to maintain ease of operation, then ease of operation is improved, but security vulnerabilities increase
Solution Approach 1:
The system implements continuous feedback by having the monitoring service constantly observe the behavior of imported packages and compare it against established profiles. When deviations indicating malicious activity are detected, the system provides feedback by blocking suspicious operations or alerting administrators, maintaining ease of operation while eliminating blind trust through active monitoring.
Data Source
AI summary
Disclosed are various embodiments for detecting malicious activities by imported software packages. A monitoring service determines that untrusted code executing in at least one computing device has invoked a privileged operation. A context in which the privileged operation is invoked is identified. The monitoring service determines whether the context and the privileged operation corresponds to an expected behavior of the untrusted code based at least in part on a past behavior profile of the untrusted code. An action is performed in response to determining that the context and the privileged operation do not correspond to the expected behavior.