Process Creation Interception via DLL Injection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer systems lack effective solutions for detecting process creation events, particularly in Windows environments, where methods like device driver failures, SDT patching, and late API calls are inadequate, leading to security vulnerabilities and limited control over program access.
Innovation Solution
A computer-implemented method and system that injects an interceptor module into a native operating system process to detect and control the creation of program instances by replacing addresses in an address table with an interceptor routine, obtaining parameters, and analyzing them to determine if the process corresponds to a program of interest, thereby facilitating access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If device driver or SDT patching methods are used to detect process creation, then process detection capability is improved, but system stability deteriorates due to driver failures and crashes
Solution Approach 1:
The patent introduces an intermediary mechanism by injecting a DLL into a process and hooking into its address table to intercept process creation calls. This mediator approach allows detection without requiring system-wide driver-level access, avoiding the stability issues of traditional driver patching methods while maintaining detection capability.
Solution Approach 2:
The patent replaces the mechanical/system-level approach of device driver patching with a software-level solution using DLL injection and address table manipulation. This substitution moves the detection mechanism from kernel-mode driver operations to user-mode process manipulation, eliminating crash-prone driver failures while achieving the same detection goal.
2Ease of operation
If administrator accounts are used to access programs, then program access capability is improved, but security deteriorates due to increased vulnerability to malicious software
Solution Approach 1:
The patent applies local quality by enabling non-administrator accounts to access specific programs through individual process control. Instead of requiring system-wide administrator privileges, the system allows selective access control at the process level, granting program access only when needed and only to authorized users, thus maintaining security while enabling operational capability.
Solution Approach 2:
The patent introduces dynamic access control where program accessibility is not fixed by static user accounts but can be dynamically adjusted based on process creation events. The system can dynamically allow or block specific processes for specific users at the moment of access, providing flexible security that adapts to operational needs without compromising overall system security.
3Object-affected harmful factors
If non-administrator accounts are used to improve security, then security is improved, but program access capability deteriorates due to limited options for configuring individual program access
Solution Approach 1:
The patent implements feedback mechanisms where the system monitors process creation events and provides real-time information about attempted program access. This feedback loop allows non-administrator users to understand why certain programs are blocked and enables administrators to make informed decisions about access control, improving both security and ease of operation through transparent, actionable information.
Solution Approach 2:
The patent applies preliminary action by intercepting process creation calls before they can execute. The system proactively checks whether a user should be allowed to access a specific program based on configured policies, and prevents access before potential security issues arise. This proactive approach maintains security while simplifying the user experience by handling access control automatically rather than requiring complex manual configuration.
Data Source
AI summary
A system for detecting creation of a program instance includes an interceptor routine that obtains a parameter corresponding to a characteristic of a program instance and an interceptor module that can be injected into a native operating system process. In certain examples, the interceptor module can replace an address of a selected routine in an address table with an address to the interceptor routine, such that the native operating system process can call the interceptor routine in place of the selected routine. Additionally, the system can include a comparison module that compares the parameter to a set of identified programs to determine whether the program instance corresponds to at least one of the identified programs. The system can also include a security module that can modify execution of the program instance based at least in part on a determination that the program instance corresponds to at least one identified program.