Network Action Control List for Malware Containment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Malware infections often compromise network services, allowing malicious actions that can further compromise computer systems, and existing security measures like anti-virus software and firewalls may not prevent all infections or contain the damage effectively.
Innovation Solution
A computer system with a network action processing module that validates network actions against a control list to block invalid actions, ensuring only 'good' network activities are permitted, using a network action control list generated from service manifests and configured by administrators to identify valid actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security measures (anti-virus software and firewalls) are used, then basic protection against malware is provided, but malware infections still succeed in compromising network services
Solution Approach 1:
The system performs preliminary validation of network service actions by maintaining a control list of approved actions before malware can execute harmful operations. The validation module checks each network service action against the control list in advance, preventing unauthorized actions before they can compromise the system.
Solution Approach 2:
A network service validation module is introduced as an intermediary between network services and the network. This module intercepts and validates all network service actions, acting as a mediator that filters out malicious actions while allowing legitimate ones to proceed.
2Adaptability or versatility
If network services are allowed to perform unrestricted network actions, then service functionality is maintained, but malware can coerce services to perform malicious actions
Solution Approach 1:
The system segments network service actions into distinct categories by creating a control list that separates approved actions from unauthorized ones. Each network service action is individually evaluated against the control list, allowing legitimate actions to proceed while blocking malicious ones.
Solution Approach 2:
The validation module implements a feedback mechanism where each network service action is checked against the control list, and the result (permit or block) is immediately returned to the network service. This feedback loop ensures that only authorized actions are executed while providing real-time security enforcement.
3Reliability
If network actions are validated against a control list, then malicious actions are blocked, but additional validation overhead is introduced
Solution Approach 1:
The control list of approved network actions is prepared in advance and loaded into the validation module before runtime. This preliminary preparation allows the validation process to proceed efficiently by simply comparing incoming actions against the pre-defined control list, rather than performing complex analysis in real-time.
Data Source
AI summary
A computer system having secured network services is presented. The computer system comprises a processor, a memory, and a network action processing module. The network action processing module processes network actions from one or more network services executing on the computer system. The computer system is further configured to execute at least network service performing network actions in conjunction with the network action processing module. Upon receiving a network action from a network service, the network action processing module determines whether the network action is a valid network action according to a network action control list. If the network action is determined to not be a valid network action, the network action is blocked. Alternatively, if the network action is determined to be a valid network action, the network action is permitted to be completed.