Endpoint Malware Detection via Selective System Call Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security technologies for endpoint systems face issues with high false positives, complex management, unacceptable performance load, and lack of automatic responses, making them ineffective against modern malicious software attacks, especially those using polymorphism and zero-day attacks.
Innovation Solution
A security system that intercepts and intermediates specific calls between the CPU and Kernel/OS, and between applications and the Kernel/OS, using a low-level data collector and Kernel modules to store call IDs, which are then analyzed by an Analytic Engine to generate a threat analysis and trigger responsive actions, minimizing performance impact by only examining a subset of calls.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security systems monitor all system calls to detect malware, then detection capability is improved, but system performance deteriorates due to unacceptable performance load
Solution Approach 1:
The patent segments the monitoring system into two distinct modules: a low-level collector that intercepts minimal hardware events and system calls, and a behavioral analytics engine that performs sophisticated analysis. This segmentation allows the system to monitor only critical events (reducing performance impact) while maintaining comprehensive malware detection through advanced analytics on the subset of captured data.
Solution Approach 2:
The patent extracts only the most critical system calls and hardware events from the full stream of system activity, storing identifying information for a predetermined selection of first-tier calls between CPU and Kernel/OS and second-tier calls between applications and Kernel/OS. By taking out only these essential events for analysis, the system maintains detection capability while minimizing performance overhead.
2Reliability
If security systems use fully virtualized environments to analyze behavior patterns, then malware detection accuracy is improved, but system performance deteriorates due to performance impacts from data acquisition and process intermediation
Solution Approach 1:
The patent introduces a low-level collector as an intermediary component that sits between the CPU/Kernel and applications, intercepting only specific hardware events and system calls. This intermediary approach allows behavioral analysis without requiring full virtualization, as the collector gathers sufficient behavioral data through selective interception while minimizing disruption to normal system operation.
Solution Approach 2:
The patent applies partial action by monitoring only a predetermined selection of critical system calls and hardware events rather than all system activity. The low-level collector intermediates a subset of first-tier calls (CPU to Kernel/OS) and second-tier calls (applications to Kernel/OS), providing enough behavioral data for accurate malware detection while avoiding the performance penalties of comprehensive monitoring.
3Reliability
If security systems rely on signature-based detection methods, then detection of known malware is improved, but detection capability deteriorates against polymorphic and zero-day attacks
Solution Approach 1:
The patent implements feedback mechanisms where the behavioral analytics engine continuously learns from analyzed system call patterns and hardware events. The system uses machine learning to adapt to new malware behaviors, allowing it to detect both known malware through established patterns and zero-day attacks through anomaly detection in behavioral sequences, thereby improving both known malware detection and adaptability to new threats.
Solution Approach 2:
The patent changes the detection parameter from static malware signatures to dynamic behavioral patterns captured through system call interception. By monitoring sequences of system calls, hardware events, and their temporal relationships, the system can identify malicious behavior regardless of malware signature variations, enabling effective detection of polymorphic and zero-day attacks while maintaining detection of known threats.
4Reliability
If security systems provide manual analysis and response to detected threats, then detection accuracy is improved through human interpretation, but response time deteriorates due to months of latency
Solution Approach 1:
The patent implements self-service automation where the security system performs both detection and response actions autonomously without human intervention. The behavioral analytics engine automatically analyzes intercepted system calls and hardware events, identifies malware threats, and triggers appropriate response actions, eliminating the months-long latency of manual analysis while maintaining high detection accuracy through sophisticated analytics.
Solution Approach 2:
The patent prepares response actions in advance by pre-configuring the system with detection rules and response protocols. When malware is detected through behavioral analysis, pre-planned response actions are immediately executed, eliminating delays associated with human decision-making and enabling rapid mitigation of threats while maintaining accurate identification through advanced analytics.
Data Source
AI summary
A security system and method secures and responds to security threats in a computer having a CPU, a Kernel/OS, and software applications. A data collector intercepts a selection of first tier calls between the CPU and Kernel/OS and/or second tier calls between the Kernel/Operating System and the applications, and stores information pertaining thereof. An Analytic Engine maps the stored first and second tier call information to a rulebase containing patterns of security threats, to generate a threat analysis, and then responds to the threat analysis. The Analytic Engine enlarges or contracts the selection of first and second tier calls to increase or decrease specificity of the threat analysis. A Management Module generates user interfaces accessible remotely by a user device, to update the rulebase and configure the collector, the Kernel module, and the Analytic Engine.