Privilege Escalation Detection via Behavioral Resource Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies struggle to efficiently detect privilege escalations in computer systems, as they often rely on code analysis that may not identify vulnerabilities caused by incorrect permissions configurations, which can vary between hosts.
Innovation Solution
Collect behavioral data from privileged applications to create databases of high-privileged executables and sensitive resources, and analyze these to identify potential vulnerabilities by examining writable resources with lower privileges, generating indications for potential privilege escalations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If code analysis is used to detect privilege escalation vulnerabilities, then the detection process is straightforward, but it fails to identify vulnerabilities caused by incorrect permissions configurations that vary between hosts
Solution Approach 1:
The system performs preliminary actions by collecting behavioral data from privileged applications and creating databases of high-privileged executables and sensitive resources before conducting vulnerability detection. This preliminary data collection enables more accurate detection of permission configuration vulnerabilities without requiring complex real-time analysis
Solution Approach 2:
The patent introduces behavioral data databases as an intermediary between the detection system and the target host. These databases contain pre-collected information about privileged executables and sensitive resources, serving as a mediator that enables accurate vulnerability detection without requiring direct complex analysis of the target system's permission configurations
2Reliability
If comprehensive behavioral data collection is performed to improve vulnerability detection, then detection reliability improves, but the time and resources required increase
Solution Approach 1:
Behavioral data is collected and stored in databases in advance, before vulnerability detection is needed. This preliminary action allows the detection process to query pre-processed data rather than collecting and analyzing all behavioral data in real-time, significantly reducing detection time while maintaining reliability
Solution Approach 2:
The system collects and stores more behavioral data than immediately necessary, creating comprehensive databases of privileged executables and sensitive resources. This excessive data collection upfront enables faster, more reliable detection later by having all necessary information readily available for comparison and analysis
Data Source
AI summary
An arrangement and a method of privilege escalation detection in a computer or computer network. The method comprises examining which executables are running in a target host; searching from a behavioral data source behavioral information of the executables running in the target host; including in a first list identification information of executables running in the target host which the behavioral information indicates are known to run with a first or a higher level privilege; including in a second list identification information of sensitive resources loaded or executed by the executables included in the first list; examining the sensitive resources included in the second list to determine whether that resource is writable by an executable running at a privilege level lower than the first level; and providing an indication of every resource that is loaded by the first or higher level privilege executable but is writable by the executable running at a privilege level lower than the first level as a potential vulnerability.