Rolling Hash Memory Whitelisting for DLL Injection Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional hashing algorithms, such as MD5 and SHA1, are inadequate for detecting compromised executable files in memory, as they produce different hash results for trivial modifications, leading to unnecessary risk mitigation and disruption of legitimate programs.
Innovation Solution
Implementing a rolling hash algorithm to analyze executable files loaded into memory, allowing for the detection of changes and determining their location and extent, thereby distinguishing between legitimate and compromised files.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional hashing algorithms (MD5, SHA1) are used on static executable files, then file integrity can be verified, but trivial modifications cause false positives and unnecessary risk mitigation
Solution Approach 1:
The patent segments the executable file into multiple sections (e.g., code section, data section, resource section) and generates separate hash values for each section rather than a single hash for the entire file. This allows trivial modifications in non-critical sections (like resource sections) to be distinguished from malicious changes in critical sections (like code sections), thereby reducing false positives while maintaining detection accuracy for actual compromises.
2Reliability
If conventional hashing compares static files on hard drive, then compromised files can be detected, but changes occurring in memory after loading (e.g., DLL injection) cannot be detected
Solution Approach 1:
The patent generates hash values for each section of the executable file when it is loaded into memory, before any potential malicious modifications occur. These preliminary hash values are stored and later compared against the actual sections in memory during execution. This preliminary action enables detection of memory-based compromises such as DLL injection, where code is injected after the original file has been loaded, because the system already has the baseline hash values to compare against.
3Device complexity
If traditional hashing takes input data as a whole, then a single fingerprint is produced, but the location and extent of changes cannot be determined
Solution Approach 1:
The patent divides the executable file into multiple identifiable sections and generates separate hash values for each section. This segmentation preserves information about which specific part of the file has been modified, allowing the system to determine both the location (which section) and extent (hash difference magnitude) of changes. This approach maintains relative simplicity while recovering the location information that would be lost in traditional whole-file hashing.
Data Source
AI summary
An enhanced whitelisting module associated within a system whitelists unknown files for execution on the system. The whitelisting module may oversee the computation of a hash of a file loaded into the memory and comparison of the hash to hashes within a hash table generated from clean files located on a clean system. The whitelisting module may communicate to a device internal and/or external to the system to retrieve the hash table of clean files. In certain embodiments, a rolling hash (or other piecewise hash) may be used to determine the location and/or extent of the differences between a modified file and a clean file.