System Call Filter for Network Access Privilege Management
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current APT detection and mitigation systems are ineffective in adapting to rapid APT innovations, often failing to detect APT attacks in a timely manner, and lack the context to differentiate standard Web traffic from data exfiltration, leading to vulnerabilities in computer networks.
Innovation Solution
A permission request system that intercepts and monitors system calls, implements agnostic access control lists, and provides a user interface for on-demand system call resolution, anomaly detection, and user interaction to manage privilege access and detect anomalous behavior, thereby preventing unauthorized access and malicious activities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If computer systems allow all users to modify the computer system's internal structures, then ease of operation is improved, but security against malware is worsened
Solution Approach 1:
The patent segments user privileges into different levels (standard users vs. administrators) and further divides access rights into specific system calls and resources. This allows standard users to access common resources while preventing them from modifying critical system structures, thus maintaining ease of operation for legitimate users while blocking malware from gaining system-wide control.
Solution Approach 2:
The patent introduces a system call filter as an intermediary component between applications and the operating system kernel. This filter intercepts system calls, evaluates them against security policies, and only allows permitted calls to reach the kernel. The intermediary blocks malicious system calls from reaching critical system structures while allowing legitimate operations to proceed.
2Ease of operation
If scripting applications execute with all privilege rights of the user, then ease of operation is improved, but security against malware is worsened
Solution Approach 1:
The patent segments privilege rights into specific system call permissions rather than granting blanket access. Scripting applications receive only the specific privileges needed for their intended function, as determined by security policies. This prevents malware from exploiting broad privilege grants to subvert the system.
Solution Approach 2:
The system call filter acts as an intermediary that intercepts and evaluates system calls from scripting applications before they execute. The filter compares each system call against predefined security policies and only permits calls that are explicitly allowed, thereby blocking malware from executing privileged operations even when running as a user application.
3Difficulty of detecting and measuring
If deep log analyses and log correlation are performed to detect APT attacks, then detection capability is improved, but device complexity is worsened
Solution Approach 1:
The patent performs preliminary security checks at the system call level before APT attacks can execute malicious operations. By filtering system calls in advance and blocking potentially harmful operations before they occur, the system reduces the need for complex post-event log analysis while maintaining strong detection and prevention capabilities.
Solution Approach 2:
The system call filter serves as an intermediary that simplifies security monitoring by centralizing the evaluation of system calls in one location. Instead of requiring complex distributed log correlation across multiple sources, the filter provides a unified interface for security policies, making the system more manageable while maintaining comprehensive monitoring capabilities.
Data Source
AI summary
A method for detecting, identifying, and mitigating advanced persistent threats in a computer network having one or more computers includes a processor in the computer network: receiving a request to access a resource in the computer network; identifying the request as originating from an application executing on the computer network; executing an anomaly operation to determine a behavior of the application is one of anomalous and not anomalous; executing a privilege operation to determine the request is one of permanently allowed and not-permanently allowed; granting access to the resource for both a non-anomalous-behaving application and a permanently allowed request; and generating and displaying, on a graphical user interface of the computer network, and prompt for either an anomalous-behaving application or a not-permanently allowed request.