Security Agent for Malicious Thread Suspension Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security systems fail to effectively detect and mitigate malicious thread suspension attacks, where malware injects itself into privileged processes by launching them in a suspended state and modifying their memory, making it difficult for antivirus scanners to recognize the subverted processes as malicious.
Innovation Solution
A security agent is implemented to monitor process launches and suspensions, detect suspicious behavior such as launching a process in a suspended state and modifying its memory, and classify such actions as potentially malicious, allowing for remedial actions to be taken, including blocking or quarantining the subverted process.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus scanners are used to detect malicious processes, then detection capability is provided, but malicious thread suspension attacks can evade detection by injecting themselves into suspended privileged processes
Solution Approach 1:
The security agent performs preliminary actions by monitoring and detecting the suspension of privileged processes before malware can successfully inject and execute. The system proactively identifies suspicious suspended processes and prevents their malicious modification, rather than reacting after infection occurs.
Solution Approach 2:
The security agent acts as an intermediary between the operating system and malware, monitoring process creation and suspension events. It intercepts attempts to suspend privileged processes and blocks malicious modifications before they can compromise the system, serving as a protective layer between legitimate processes and malware attacks.
2Reliability
If security monitoring is implemented to detect process launches and modifications, then malicious activity can be identified, but false positives may occur from legitimate process modifications
Solution Approach 1:
The security agent applies different monitoring rules and analysis methods to different processes based on their privileges and characteristics. High-privileged processes receive enhanced monitoring and verification, while standard processes use lighter monitoring, optimizing detection accuracy while reducing false positives and system overhead.
Solution Approach 2:
The system dynamically adjusts monitoring parameters and thresholds based on process characteristics, system state, and threat levels. This allows the security agent to adapt its detection sensitivity, reducing false positives from legitimate modifications while maintaining high detection rates for actual threats.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In an example, there is disclosed a computing apparatus having one or more logic elements providing a security agent operable for: detecting that a first process has launch a second process and placed the second process in a suspended state; detecting that the first process has modified or attempted to modify the second process; classifying the modification as potentially malicious; and taking a remedial action. There is also disclosed one or more computer-readable storage mediums having stored thereon executable instructions for providing the security agent, and a computer-executable method of providing the security agent.