Shadow System Call Tables for Zero-Day Malware Neutralization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional malware-detection tools are ineffective against memory-based attacks that morph their behavior and exploit unknown vulnerabilities, leading to performance issues and missed detections, especially in zero-day attacks.
Innovation Solution
Modify the system call table by creating a shadow table with randomized index numbers and trap functions, patching valid applications to use the randomized indices, and using a hooking function to route execution based on index types, neutralizing malicious processes that reference the original, non-randomized indices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional runtime activity monitoring is used to detect malicious behavior, then detection capability is provided, but detection precision deteriorates due to morphing behavior and lack of prior knowledge
Solution Approach 1:
The patent applies preliminary action by pre-modifying the system call table to include trap functions at critical entry points before malicious code execution. The system call table is advanced-modified to insert trap functions that automatically detect and neutralize unauthorized code injection attempts, enabling detection without requiring prior knowledge of specific attack patterns or morphing behaviors.
2Reliability
If signature-based antivirus products are used, then known malware detection is provided, but effectiveness deteriorates against memory-based attacks and zero-day exploits
Solution Approach 1:
The patent implements self-service by enabling the system to automatically detect and neutralize malicious code through self-modifying capabilities. The system call table is dynamically modified to include trap functions that autonomously detect unauthorized code injection and execution attempts, eliminating the need for external signature databases or prior knowledge of attack patterns, thereby providing effective protection against zero-day exploits and memory-based attacks.
3Reliability
If runtime activity monitoring is implemented, then security monitoring is provided, but system performance deteriorates due to computational resource requirements
Solution Approach 1:
The patent applies the extraction principle by isolating security monitoring functionality into dedicated trap functions within the system call table, separate from the main application execution flow. These trap functions are selectively invoked only when unauthorized code injection attempts occur, rather than continuously monitoring all runtime activity, thereby providing effective security monitoring with minimal impact on overall system performance and computational resources.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques are provided for neutralizing attacks by malicious code on a computer system. In an embodiment, this is achieved by modifying certain aspects of an operating system. For example, a system call table storing pointers to system functions is duplicated to create a shadow system call table. The original table is modified with traps resulting the neutralization of processes that access the table, whereas processes that access the shadow system call table are enabled to execute properly. In order for valid applications to operate with the shadow system call table, index numbers corresponding to the different system function calls are randomized in a system library that maintains function calls to such system functions. Valid applications may be patched in order to reference such randomized index numbers, whereas malicious processes continue to reference the original non-randomized index numbers.