Network Security Whitelist System for Unknown Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current IT security technologies, particularly endpoint security systems, face challenges in effectively protecting against new or unknown threats due to limitations in visibility and control, as they rely on outdated blacklists and behavioral patterns, leading to high false-alarm and missed-detection rates, and struggle with maintaining flexible policies in dynamic enterprise environments.
Innovation Solution
A security system that employs agent software on each host to analyze file system activity, using centralized policy management to implement advanced states like Pending and Locally Approved, allowing for real-time detection and tracking of new content, and utilizing Distributed Meta-Information Query and Centralized Timed Analysis to enhance scalability and responsiveness.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If blacklist-based pattern scanning is used to detect known threats, then detection capability for identified threats is improved, but the system becomes ineffective against new or unknown threats and requires perpetual updates
Solution Approach 1:
The patent inverts the traditional blacklist approach by implementing a whitelist system. Instead of maintaining a list of known bad patterns and blocking them, the system maintains a list of known good patterns and allows only those through. This inversion fundamentally changes the detection paradigm from reactive (blocking known threats) to proactive (allowing only verified safe content), thereby solving the contradiction between reliable detection of known threats and adaptability to new threats.
Solution Approach 2:
The system performs preliminary classification and approval of content before it can execute or spread. By requiring all content to be pre-approved through centralized classification or local approval mechanisms, the system ensures that only verified safe content is allowed to run. This preliminary action eliminates the need for perpetual blacklist updates while maintaining high detection reliability, as the system proactively prevents unknown threats rather than reacting to them.
2Reliability
If behavioral blacklisting is used to detect bad behavioral patterns, then detection of known malicious behaviors is improved, but false-alarm rates increase and detection accuracy decreases
Solution Approach 1:
The patent inverts the behavioral detection approach by monitoring for absence of bad behaviors rather than presence of bad behaviors. The whitelist system allows content to execute only if it demonstrates good behavioral patterns or has been pre-approved. This inversion eliminates false alarms because the system does not attempt to identify and label suspicious behaviors as malicious; instead, it simply allows content that has already been verified as safe, thereby achieving both reliable detection and high precision.
3Reliability
If whitelist systems are implemented to limit execution to approved programs, then protection against unknown threats is improved, but system flexibility and ease of operation deteriorate
Solution Approach 1:
The patent segments the whitelist approval process into multiple independent components: centralized classification authority for initial approval, local approval mechanisms for individual hosts, and automatic approval for trusted sources. This segmentation allows different parts of the system to operate with different levels of restriction, maintaining high protection where needed while preserving flexibility for local decisions and automated processes, thereby resolving the contradiction between reliability and ease of operation.
Solution Approach 2:
The system implements dynamic whitelist management where approval status can change over time and different content can have different approval levels. Content can be approved centrally, locally, or automatically based on trusted sources, and these approval states can be updated dynamically. This dynamic approach allows the system to maintain high protection while adapting to changing requirements and maintaining operational flexibility, as the whitelist is not static but responsive to new information and local needs.
4Stability of the object's composition
If centralized classification authority is used to approve or ban content, then consistent policy enforcement is improved, but response time to new threats deteriorates
Solution Approach 1:
The patent segments the approval authority into centralized and local components. The centralized classification authority provides initial approval and sets baseline policies, ensuring consistency across the network. Local hosts can then independently approve content based on their specific needs and circumstances, bypassing the centralized authority when appropriate. This segmentation maintains policy consistency through centralized guidance while enabling rapid local response to new threats, thereby resolving the contradiction between stability and response time.
Solution Approach 2:
The system performs preliminary centralized classification and approval of content before deployment. Once content is approved by the centralized authority or added to trusted sources, it receives pre-granted approval that allows rapid execution without requiring real-time centralized verification. This preliminary action ensures consistent policy enforcement through centralized approval while enabling fast response to new threats through pre-approved content and local approval mechanisms that do not require real-time centralized intervention.
Data Source
Figure 1
Figure 2
Figure 2A
AI summary
A security system provides a defense from known and unknown viruses, worms, spyware, hackers, and unwanted or unknown software. The system can implement centralized policies that allow an administrator to approve, block, quarantine, or log file activities. The system maintains file meta-information in the hosts and in the server. A host detects file operations which can cause changes to file content or file name, and updates the host and/or server meta-information as a result. Changes in server meta-information are made available to hosts.