Network Access Control via Code Injection Thread Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional network access control systems, such as Internet Connection Firewall (ICF), are unable to effectively block malicious packet traffic generated by malware injected into processes with allowed communication IDs, as they only filter based on process IDs, leading to vulnerabilities in security and user convenience.
Innovation Solution
A network access control system that includes a process inspection unit to detect code injection-based threads and a network monitoring unit to selectively allow or block network packet traffic based on both process and thread IDs, using network filtering to identify and block code injection-based threads.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network access control is based on process ID only, then normal process communication is allowed, but malicious code injected into the process cannot be blocked
Solution Approach 1:
The patent segments the process identification into two levels: process ID for basic identification and thread ID for granular control. This segmentation allows the system to distinguish between legitimate threads and malicious injected threads within the same process, enabling selective blocking of malicious code while maintaining normal process communication.
Solution Approach 2:
The patent adds a new dimension (thread ID) to the existing access control mechanism that only used process ID. This dimensional expansion transforms the control granularity from process-level to thread-level, enabling the system to identify and block malicious threads while allowing legitimate threads to continue operating.
2Reliability
If all packet traffic from a process is blocked, then malicious code is prevented from communicating, but normal process functionality is disrupted
Solution Approach 1:
The patent segments network traffic control at the thread level rather than blocking entire processes. This allows the system to selectively block only the malicious thread that executed the injected code while permitting other legitimate threads within the same process to continue their normal communication functions.
Solution Approach 2:
The patent applies different access control qualities to different threads within the same process. Legitimate threads receive permission to communicate while the malicious thread is blocked, creating localized security enforcement that preserves overall process functionality while eliminating the security threat.
3Reliability
If code injection detection is added to the access control system, then malicious threads can be identified, but system complexity increases
Solution Approach 1:
The patent implements preliminary detection of code injection by monitoring for the presence of malicious threads before they can execute harmful operations. The system proactively identifies injected code through thread analysis and prevents its execution, stopping the attack chain before it can cause damage.
Solution Approach 2:
The patent introduces an intermediary detection layer that analyzes thread characteristics to identify code injection. This intermediary mechanism sits between the process and the network access control, providing specialized detection capabilities without requiring fundamental changes to the underlying operating system or network stack.
Data Source
AI summary
The present invention relates to a system and method for controlling a network access of a network packet on the basis of a thread which is inserted into a process through code injection. The network access control system according to the present invention comprises: a process inspecting unit for detecting a code injection-based thread included in a process; and a network monitoring unit for performing network filtering so as to detect a network packet having access to a network, and, if a communication subject of the detected network packet is the code injection-based thread, blocking the traffic of the detected network packet.