Privileged Process Memory Fingerprinting for Unauthorized Modification Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computing devices face security risks due to unauthorized modifications of software modules operating with elevated privileges, which can lead to malicious activities such as data theft and unauthorized operations, as existing methods fail to effectively monitor and validate these privileged processes during system startup and operational phases.
Innovation Solution
A method that involves creating snapshots of memory during the system startup phase and periodically comparing them with present snapshots to detect any modifications, using cryptographic hash values to identify changes, and maintaining a dynamic whitelist of authorized processes to monitor and control privileged operations, thereby ensuring the integrity and security of the system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software modules operating with elevated privileges are protected by various techniques, then security against unauthorized modifications is improved, but the ability to detect and respond to modifications during execution is worsened
Solution Approach 1:
The system creates snapshots of privileged process memory during the startup phase before any modifications can occur, establishing a baseline for later comparison. This preliminary action enables detection of subsequent modifications without interfering with the security protections in place.
Solution Approach 2:
The system implements continuous monitoring that periodically compares current memory snapshots against the baseline snapshot, providing feedback when modifications are detected. This feedback mechanism enables real-time detection while maintaining the security protections that were already in place.
2Difficulty of detecting and measuring
If snapshots of memory are created and compared to detect modifications, then detection capability is improved, but system performance and resource usage are worsened
Solution Approach 1:
Instead of continuous monitoring, the system performs snapshot comparisons at periodic intervals during the operational phase. This periodic action reduces the computational overhead and resource consumption while still maintaining effective detection capability for modifications.
Solution Approach 2:
The baseline snapshot is created during the startup phase in advance, so that subsequent comparisons during operation only need to compare against this pre-established baseline. This preliminary preparation reduces the computational burden during operational monitoring.
3Measurement precision
If cryptographic hash values are used to identify changes in memory contents, then measurement precision is improved, but computational overhead and processing time are worsened
Solution Approach 1:
The system creates copies of memory contents in snapshot form and performs hash comparisons on these copies rather than directly analyzing the entire memory contents. This copying approach enables precise change identification through cryptographic hashing while reducing the processing time by working with condensed hash representations.
4Reliability
If a dynamic whitelist of authorized processes is maintained, then security control is improved, but device complexity is worsened
Solution Approach 1:
The whitelist of authorized privileged processes is established during the startup phase before normal operation begins. This preliminary establishment of the authorization list simplifies the ongoing monitoring complexity by providing a clear reference against which to validate process legitimacy.
Solution Approach 2:
The system maintains a simplified representation of authorized processes in the whitelist rather than implementing complex access control mechanisms. This copying approach to authorization management reduces the complexity of the monitoring system while maintaining effective security control.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system (200, 400) and method (300, 500) to monitor executing processes are disclosed. A respective starting fingerprint of memory of each executing process within at least one process is determined during a system startup phase that is prior to a device operational phase (308). A present fingerprint of memory of the selected executing process within the at least one process is determined during the device operational phase and while a selected executing process is executing (314). A difference between the respective starting fingerprint of the selected executing process and the present fingerprint of the selected executing process is determined (316) and an indication of the difference for the selected executing process is reported based on determining the difference (318).