Physical Input Correlation for Unauthorized Process Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security measures, such as those described in Japanese Patent No. 4995170, fail to detect unauthorized use of processes in information processing apparatuses, particularly in cases where attackers exploit normal processes to launch attacks like denial of service (DOS) by abusing authorized functions, making it difficult to defend against sophisticated cyberattacks.
Innovation Solution
An information processing apparatus equipped with a monitoring unit to track physical inputs, a specifying unit to determine execution conditions, and a detecting unit to identify unauthorized process execution by comparing the timing of physical inputs with specified conditions, thereby implementing security measures when deviations are detected.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a monitoring monitor is installed for each module to monitor API and system call behavior, then the system can detect abnormal behavior patterns, but it fails to detect unauthorized use of normal processes such as DOS attacks that abuse authorized functions
Solution Approach 1:
The patent introduces a new dimension of monitoring by tracking the temporal relationship between physical inputs and process execution. Instead of only monitoring the internal behavior of processes (as in Japanese Patent No. 4995170), the system now monitors whether process execution is properly triggered by corresponding physical inputs, adding a temporal correlation dimension that enables detection of unauthorized process usage even when the process itself behaves normally.
Solution Approach 2:
The patent uses physical input monitoring as an intermediary mechanism to detect unauthorized process execution. By introducing physical input tracking as a mediator between user actions and process execution, the system can identify discrepancies where processes execute without corresponding physical inputs, thereby detecting attacks like DOS that abuse authorized functions without leaving traditional behavior logs.
2Object-affected harmful factors
If traditional security measures such as malware detection and firewalls are implemented, then known network boundary attacks can be defended against, but sophisticated zero-day attacks and unauthorized process usage remain undetected
Solution Approach 1:
The patent implements a feedback mechanism where the system continuously monitors the correlation between physical inputs and process execution, comparing actual execution patterns against expected behavior. This feedback loop enables the system to detect deviations from normal operation, such as processes executing without corresponding physical inputs, thereby identifying sophisticated attacks that traditional firewalls and malware detection cannot detect.
Data Source
AI summary
An information processing apparatus configured to detect unauthorized execution of a process, the information processing apparatus comprising: a monitoring unit configured to monitor a physical input to the information processing apparatus; a specifying unit configured to specify an execution condition of the process; and a detecting unit configured to detect unauthorized execution of the process based on the physical input monitored by the monitoring unit and the execution condition specified by the specifying unit.