Process Termination Delay for Threat Data Capture
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security features in computer systems often terminate processes upon detecting threats, preventing the capture and analysis of malware and social engineering attacks, which can lead to missed opportunities for data collection and improved security measures.
Innovation Solution
A method and system that delay the termination of processes to capture data related to potential threats by allowing monitored events to execute until a predetermined indicator is triggered, recording associated data, and transmitting it for analysis, while terminating the process to prevent harm.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the process is terminated immediately upon detecting a threat event, then system security is improved by preventing malware execution, but the opportunity to capture and analyze threat data is lost
Solution Approach 1:
The system performs preliminary data capture actions before terminating the process. A monitoring module records threat-related data (URLs, files, processes) in advance of termination, ensuring the information is preserved for later analysis while still preventing the malware from completing its harmful execution
Solution Approach 2:
The patent introduces a monitoring module as an intermediary between the threat detection mechanism and the process termination. This intermediary captures and preserves threat data before the termination occurs, acting as a buffer that allows both security termination and data preservation to coexist
2Loss of information
If the process is allowed to continue executing to capture complete threat data, then data collection is improved, but system security is compromised by allowing malware to execute
Solution Approach 1:
The system extracts only the necessary threat data (URLs, file paths, process information) from the executing process without allowing the process to complete its harmful execution. The monitoring module pulls out the relevant information while the termination prevents the malware from achieving its full harmful potential
Solution Approach 2:
The system rushes through the data capture process quickly during the brief window before termination. The monitoring occurs in real-time and captures essential data in the short period allowed before the process is terminated, skipping the need to wait for complete execution
3Difficulty of detecting and measuring
If monitoring is performed on all processes to detect threats, then detection capability is improved, but system performance decreases due to increased processing overhead
Solution Approach 1:
Instead of uniformly monitoring all processes with the same level of intensity, the system applies monitoring selectively based on local conditions. The monitoring module focuses resources on processes that exhibit suspicious behavior or match known threat patterns, reducing overhead for benign processes while maintaining high detection capability for threats
Data Source
AI summary
A computer-implemented method for delaying termination of a process to capture data relating to a potential threat is described. A process that executes an event that indicates a threat is monitored. The event is allowed to execute on the process until a predetermined indicator is triggered. Data associated with the execution of the event is recorded when the predetermined indicator is triggered. The recorded data is transmitted to a processing system for analysis. The process is terminated from continuing to execute the event.