Process Execution Profiling for Malicious Activity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security solutions, such as sandboxing and whitelisting, often restrict operations and access for processes entirely, leading to interoperability issues and difficulties in allowing legitimate operations to persist data between sessions, while failing to effectively detect and stop malware exploiting host processes.
Innovation Solution
A communication system that includes an execution profiling module to monitor and validate code accessing sensitive and privileged resources, allowing normal operations unless privileged actions are initiated, and using a blacklist and whitelist to ensure only legitimate code executes, thereby reducing the risk of malware breakout.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sandboxing and whitelisting are used to restrict operations and access for processes, then security is improved, but interoperability issues arise and legitimate operations cannot persist data between sessions
Solution Approach 1:
The patent implements different security policies for different code regions within a process. Trusted code is allowed to access privileged resources and persist data, while untrusted code is restricted. This local differentiation resolves the contradiction by allowing legitimate operations (trusted code) to function normally while maintaining security restrictions for potentially malicious code.
Solution Approach 2:
The patent segments the process code into trusted and untrusted portions using stack frame analysis. By dividing the code execution context into segments with different security levels, the system can apply appropriate access controls to each segment, enabling interoperability for trusted operations while maintaining security against untrusted code.
2Reliability
If sandboxing and whitelisting are used to restrict operations and access for processes, then security is improved, but malware exploiting host processes can still break out
Solution Approach 1:
The patent performs preliminary analysis of the call stack to identify trusted code origins before allowing access to privileged resources. By pre-establishing trust relationships with legitimate code sources (such as Microsoft Corporation), the system proactively prevents malware from exploiting host processes, as the malware cannot impersonate trusted code origins.
Solution Approach 2:
The patent implements continuous monitoring of code execution through stack frame analysis, providing feedback on whether the currently executing code is trusted or untrusted. This real-time feedback mechanism enables dynamic enforcement of security policies, allowing the system to detect and prevent malware breakout attempts while maintaining security.
3Ease of operation
If complex rules and special-case exceptions are implemented to allow legitimate operations, then interoperability is improved, but device complexity increases
Solution Approach 1:
The patent enables code to effectively self-identify its trustworthiness through stack frame analysis. The system automatically traces the call stack to determine the origin of executing code, eliminating the need for complex manual configuration rules. This self-service approach resolves the contradiction by allowing legitimate operations to proceed automatically based on their inherent trust attributes rather than requiring complex policy rules.
Data Source
AI summary
Particular embodiments described herein provide for an electronic device that can be configured to intercept a process, store execution profiling for the process if the process involves a privileged resource or a privileged operation, and analyze the code involved in each stack frame to determine malicious activity. If the process does not involve a privileged resource or a privileged operation, then the process is not analyzed.