Storage Device APT Protection via Pre-Write Hash Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current APT detection methods, based on static file object scans and hash-based malware signatures, are ineffective against polymorphic and zero-day threats, and fail to detect malware before it is stored within an organization's infrastructure.
Innovation Solution
A method and system that utilize a temporary storage device to compute a hash value of a file object and compare it to an APT database, with further analysis using APT signature characteristics to determine if the file object presents an APT, preventing its storage if detected, and integrating with storage device-based data de-duplication processes for efficient pattern matching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional hash-based malware signature detection is used, then known malware can be detected, but polymorphic and zero-day threats cannot be detected
Solution Approach 1:
The system performs preliminary actions by computing hash values and executing analysis on file objects before they are stored in the storage device. This pre-storage detection allows the system to identify and block polymorphic and zero-day threats before they can infiltrate the organization's infrastructure, resolving the contradiction between detecting known malware and adapting to new threats
Solution Approach 2:
The patent introduces an intermediary analysis component that sits between the file write request and the storage device. This intermediary executes comprehensive APT analysis on file objects, including polymorphic and zero-day threats, before allowing them to be stored. The intermediary acts as a mediator that enhances detection capabilities without requiring changes to the storage device itself
2Reliability
If APT detection is performed after file storage, then malware can be detected within the infrastructure, but prevention before storage is not achieved
Solution Approach 1:
The system performs APT detection as a preliminary action before files are stored in the storage device. By intercepting file write requests and executing comprehensive analysis including hash computation and APT signature matching before storage, the system prevents malware infiltration at the earliest possible point, eliminating the time loss associated with post-storage detection
3Reliability
If comprehensive APT analysis is executed on every file object, then detection accuracy improves, but processing time and system resources increase
Solution Approach 1:
The patent segments the APT detection process into distinct stages: initial hash computation, APT database comparison, and detailed APT analysis. This segmentation allows the system to perform quick hash-based filtering first, then apply more resource-intensive analysis only when necessary, maintaining detection accuracy while improving overall processing throughput
Solution Approach 2:
The system applies partial analysis actions to all file objects (hash computation and database comparison) and reserves excessive/detailed analysis (full APT analysis) for suspicious files only. This partial/excessive action approach ensures that common files are processed quickly while maintaining high detection accuracy for potential threats
Data Source
AI summary
An embodiment of a system and method for providing storage device-based advanced persistent threat (APT) protection receives a file write request of a file object, writes the file object to a temporary storage device, computes a hash value of the file object in the temporary storage device, and compares the hash value of the file object to hash values stored in an APT database to determine if the hash value of the file object exists in the APT database. If the hash value of the file object exists in the APT database, an embodiment writes the file object to a quarantine storage location and clears the file object from the temporary storage device. If the hash value of the file object does not exist in the APT database, an embodiment executes an APT analysis on the file object to determine if the file object presents an APT.