Network Traffic Monitoring With Trust-Binary Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional endpoint detection and response (EDR) solutions are ineffective against sophisticated and polymorphic malware, leading to significant delays in detection and response times, and they rely on past trends, increasing vulnerability to new threats.
Innovation Solution
A zero trust (ZT) system that uses trust binaries to validate executable code by creating function digests and requiring a corresponding trust binary for execution, implemented with a trust agent monitoring memory operations and utilizing a blockchain proof-of-identity scheme to maintain a trust store, blocking untrusted binaries and capturing forensic data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional EDR solutions are used to detect and stop known attacks, then detection capability for known threats is improved, but response time to new attacks increases significantly (days, weeks, or months delay)
Solution Approach 1:
The system performs preliminary actions by creating trust binaries and function digests for all executable code before runtime. The trust agent pre-validates code integrity by comparing actual code against stored trust binaries, so when new malware appears, the system can immediately detect it through code comparison rather than waiting for signature updates. This preliminary validation mechanism eliminates the delay inherent in conventional EDR solutions that rely on post-detection analysis.
2Measurement precision
If conventional EDR solutions rely on past trends and known attack patterns, then detection accuracy for historical threats is improved, but vulnerability to new and polymorphic malware increases
Solution Approach 1:
The system creates exact copies of legitimate code in the form of trust binaries and stores them in a trust store. Instead of relying on patterns or signatures, the system copies the actual trusted code and compares runtime code against these copies. This copying mechanism allows the system to detect any deviation from the original code, including polymorphic malware that changes its appearance, while maintaining high detection accuracy for known threats.
Solution Approach 2:
The system inverts the conventional approach by instead of asking 'does this code match known attack patterns?', it asks 'does this code exactly match the trusted original?'. This inversion transforms the detection paradigm from pattern-matching to exact comparison, enabling the system to detect new and polymorphic threats while maintaining accuracy for known threats.
3Reliability
If a trust agent validates every program loaded into memory, then security against unauthorized code is improved, but system performance and operation complexity increase
Solution Approach 1:
The system extracts the validation logic into a separate trust agent component that operates independently from the main application code. The trust agent is loaded once and reused for validating multiple programs, rather than embedding validation logic in each application. This extraction reduces overall system complexity by centralizing the validation functionality and avoiding duplication across multiple components.
Solution Approach 2:
The trust agent serves multiple functions: it validates executables, validates DLLs, manages the trust store, and handles forensic data collection. By making the trust agent a universal component that performs all validation tasks, the system avoids creating separate validation mechanisms for different code types, thereby reducing overall system complexity while maintaining comprehensive security.
4Measurement precision
If trust binaries are created and stored for all executable code, then validation accuracy is improved, but storage requirements and processing overhead increase
Solution Approach 1:
The system creates compact copies of code in the form of trust binaries and function digests rather than storing full executable files. The trust binary contains essential validation information in a condensed format, and function digests provide succinct representations of code segments. This copying approach maintains validation accuracy while significantly reducing storage requirements compared to storing complete original executables.
Data Source
AI summary
The various implementations described herein include methods and devices for monitoring network traffic. In one aspect, a method includes monitoring network packets, identifying an executable file in the network packets, and determining whether a trust store includes a trust binary corresponding to the executable file. The method also includes, when the trust store does not include the trust binary corresponding to the executable file, performing a remedial action.