API Access Restriction Using Process Trust and Call Stack Checks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security programs typically rely on signature checks to detect malicious programs, which are ineffective against unknown threats, allowing ransomware and malware to encrypt user files by accessing file systems through APIs.
Innovation Solution
Implementing a security system that intercepts API calls, evaluates the trust level of the process by comparing it to known processes and call stack attributes, and blocks untrusted processes from accessing APIs, prompting the user for override if necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature check is used to detect malicious programs, then known threats can be identified, but unknown threats and ransomware cannot be detected
Solution Approach 1:
The patent applies preliminary action by intercepting API calls before they execute and evaluating the trust level of the calling process in advance. The security system proactively blocks potentially malicious API calls by analyzing process attributes and call stack information before the actual harmful operation occurs, enabling detection of unknown threats without relying on pre-existing signatures.
2Reliability
If API calls are blocked for unknown processes, then user protection is enhanced, but false positives increase
Solution Approach 1:
The patent implements feedback by presenting a user prompt when an unknown process attempts to access an API. The system provides feedback to the user about the blocked operation and seeks user authorization to allow or deny the API call. This feedback mechanism enables users to make informed decisions about potentially legitimate applications while maintaining protection against malicious software.
3Reliability
If trust level evaluation is performed for every process, then unknown malicious processes are blocked, but system performance decreases
Solution Approach 1:
The patent applies partial action by implementing trust level evaluation only for specific API calls that require it, rather than for all process operations. The system selectively blocks API calls from untrusted processes while allowing trusted processes to operate without evaluation overhead, thus maintaining security where needed while preserving overall system performance.
Data Source
AI summary
Examples of the present disclosure describe systems and methods for restricting access to application programming interfaces (APIs). For example, when a process calls an API, the API call may be intercepted by a security system for evaluation of its trustfulness before the API is allowed to run. Upon intercepting an API call, the process calling the API may be evaluated to determine if the process is known to the security system, such that known processes that are untrusted may be blocked from calling the API. Further, when the security system cannot identify the process calling the API, the security service may evaluate a call stack associated with the call operation to determine if attributes of the call operation are known to the security system. If the call operation is known to the security system as untrusted, the call operation may be blocked from calling the API.