Process Suspension for LOLBin Malware Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current malware prevention methods fail to detect and mitigate non-malware binaries, such as Living Off The Land Binaries (LOLBins), which are used by attackers to disguise malicious activities, due to their legitimate nature and the difficulty in identifying suspicious computer processes.
Innovation Solution
Implementing a computing device with process identification, verification, and management circuitry to monitor and manage computer processes, suspending or terminating processes not used within a threshold period, and providing notifications for potential vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware prevention methods are used, then detection of known malware is maintained, but detection of non-malware binaries (LOLBins) used for malicious purposes fails
Solution Approach 1:
Instead of detecting malware based on its malicious characteristics, the system inverts the approach by monitoring legitimate processes for suspicious behavior patterns. The process monitoring circuitry tracks execution frequency, user interaction, and system behavior of legitimate binaries, identifying when they are being used for malicious purposes based on anomalous patterns rather than malware signatures.
Solution Approach 2:
The patent introduces process monitoring circuitry as an intermediary layer between the operating system and the malware detection system. This intermediary monitors process execution, tracks usage patterns, and provides behavioral data that helps identify when legitimate binaries are being used for malicious purposes, bridging the gap between traditional antivirus and threat detection.
2Reliability
If process monitoring is implemented to identify suspicious activities, then detection of disguised malware improves, but system complexity increases
Solution Approach 1:
The process monitoring circuitry is designed to perform multiple functions simultaneously: tracking process execution, analyzing usage patterns, detecting suspicious behaviors, and generating alerts. By consolidating these functions into a single multi-functional component, the system achieves comprehensive threat detection without proportionally increasing overall system complexity.
Solution Approach 2:
The system monitors multiple parameters of process execution (execution frequency, user interaction patterns, system calls, resource usage) and establishes baseline ranges for normal behavior. When parameters fall outside these ranges, the system flags potential threats. This parameter-based approach provides a systematic framework for detecting anomalies without requiring complex analysis for each individual process.
3Reliability
If legitimate processes are monitored and restricted based on suspicious behavior, then security improves, but ease of operation deteriorates due to false positives
Solution Approach 1:
The system establishes baseline behavioral patterns for legitimate processes during normal operation before threats occur. By pre-configuring expected behavior ranges and thresholds, the system can quickly evaluate process behavior against these pre-established criteria, reducing the need for complex real-time analysis and minimizing false positives that would require user intervention.
Data Source
AI summary
Methods, apparatus, systems, and articles of manufacture are disclosed to disable select processes for malware prevention, an apparatus comprising: at least one memory; instructions; and at least one processor to execute the instructions to cause the at least one processor to at least: identify execution of a computer process on a computing device; determine whether the identified computer process is in a list of computer processes to be monitored; in response to the identified computer process being listed in the list of computer processes to be monitored, determine an amount of time since last execution of the identified computer process; and suspend, in response to the amount of time since last execution meeting or exceeding a threshold time, execution of the identified computer process.