Runtime Security Agent for Process Hollowing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current data security systems are limited in detecting and remediating process hollowing intrusion attacks at the target device level, often allowing multiple breaches to occur before detection, and require manual, costly remediation efforts.
Innovation Solution
A data security system with a runtime security agent that injects detour code into running processes to intercept API calls, allowing for automatic detection and remediation of process hollowing intrusions at the process level, using techniques similar to the Microsoft Detours library to monitor and analyze API calls for signs of malicious activity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If network-level monitoring is used to detect process hollowing attacks, then detection coverage is provided, but detection timing is delayed allowing multiple breaches before identification
Solution Approach 1:
The patent applies preliminary action by injecting detour code into processes before the actual malicious execution occurs. The security agent monitors API calls at the process level, enabling early detection of hollowing attempts before they can cause multiple breaches. This proactive monitoring allows the system to intervene and remediate threats before they fully execute and spread.
2Reliability
If manual remediation of process hollowing intrusions is performed, then security personnel can respond to threats, but operational costs increase and response efficiency decreases
Solution Approach 1:
The patent implements self-service through automated remediation capabilities. When the security agent detects a process hollowing intrusion, it automatically executes remediation actions such as terminating the compromised process or applying security policies without requiring manual intervention. This automation reduces operational costs and significantly improves response efficiency while maintaining reliable security enforcement.
3Extent of automation
If detour code is injected into running processes to intercept API calls, then automatic detection and remediation is enabled, but system complexity increases
Solution Approach 1:
The patent uses an intermediary approach by introducing a security agent that acts as a mediator between processes and the operating system. The detour code injected into processes serves as an intermediary layer that intercepts API calls without requiring fundamental changes to the underlying system architecture. This modular intermediary structure enables automatic detection and remediation while managing system complexity through a standardized, reusable security component.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method and system for remediating a process hollowing intrusion on a user device comprising detecting a process starting on the user device, preparing the process to monitor Application Programming Interface (API) calls between the process and an operating system of the user device, determining whether the process is associated with a process hollowing intrusion based on information associated with the process and/or the API calls, and executing security policies against the process associated with the process hollowing intrusion. In examples, it is determined whether the child process is associated with a process hollowing intrusion in response to determining whether one or more API calls associated with known process hollowing intrusions modify executable memory of and/or modify an entry point address of the child process.