Runtime Application Self-Protection Using Allow Lists and Confidence Estimators
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing runtime self-protection technologies face challenges in achieving negligible overhead and non-interference with legitimate application execution while effectively blocking attacks, as they often rely on block listing which can be circumvented, or allow listing which may cause usability issues due to failure to list legitimate operations.
Innovation Solution
The method involves a software agent connected to a target application that collects observations in logging mode, transmits them to a security service, receives an allow list and confidence estimator model, and transitions to a blocking mode to control the application's operations based on the allow list and confidence estimator model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If block listing is used to list specific operations to block, then attack blocking capability is improved, but the system can be circumvented by performing nefarious operations not in the block list
Solution Approach 1:
The patent inverts the traditional block listing approach by implementing allow listing instead. Rather than listing operations to block, the system lists operations to permit. This inversion fundamentally changes the security model: legitimate operations are explicitly allowed in the allow list, while any operation not in the list is automatically blocked, thereby preventing circumvention by nefarious operations not in the block list.
Solution Approach 2:
The patent changes the fundamental parameter of the security list from a block list (negative control) to an allow list (positive control). This parameter change transforms the security mechanism from blocking known bad operations to permitting only known good operations, thereby improving adaptability against unknown or unlisted attacks while maintaining reliable blocking capability.
2Adaptability or versatility
If allow listing is used to list operations to allow, then circumvention resistance is improved, but failure to list a legitimate operation causes usability issues
Solution Approach 1:
The patent applies preliminary action by implementing a learning phase during which the system observes and records legitimate operations before enforcement begins. This preliminary observation period allows the allow list to be pre-populated with accurate representations of legitimate operations, ensuring that when enforcement starts, no legitimate operations are accidentally blocked, thereby maintaining usability while achieving circumvention resistance.
Solution Approach 2:
The patent incorporates feedback mechanisms that monitor application behavior and use machine learning to distinguish between legitimate and malicious operations. The system continuously learns from observed operations, adjusting the allow list dynamically based on feedback from the application's normal operation, ensuring that legitimate operations remain permitted while blocking attacks, thus maintaining both circumvention resistance and usability.
3Reliability
If runtime monitoring is implemented to detect and prevent attacks, then security is improved, but overhead and interference with legitimate execution increase
Solution Approach 1:
The patent segments the runtime protection system into distinct functional components: a learning/observation mode that collects data without interference, and an enforcement mode that blocks attacks. This segmentation allows the system to operate with minimal overhead during the learning phase, gathering necessary information without impacting legitimate execution, and then transition to targeted enforcement that blocks only malicious operations while allowing legitimate ones to proceed efficiently.
Data Source
AI summary
A method may include collecting, by a software agent connected to a target application, a set of observations of executing the target application while in a logging mode. The set of observations identifies instances of operations of the target application. The method may also include transmitting the set of observations to a security service, and receiving an allow list and a confidence estimator model from the security service. The security service generalizes the operations into multiple general operations in the allow list and trains the confidence estimator model based on the set of observations. The method may in addition include transitioning, by the software agent, to a blocking mode, and controlling, according to the allow list and the confidence estimator model, performance by the target application of second instances of second operations while in blocking mode.