System Call Interposition for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional intrusion detection systems (IDS) rely on pre-defined signatures, which are insufficient to detect unforeseen combinations of malicious codes and face challenges with signature database size explosion, leading to compromised network security.
Innovation Solution
A system call analysis mechanism that intercepts and monitors all system calls using a pre-installed system call monitor module, extracts pre-defined system calls, determines suspicious activity, executes and predicts behavior, and compares it with actual behavior to issue warnings, eliminating the need for signature-based detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional IDS uses pre-defined signature analysis to detect malicious codes, then the detection can identify known attack patterns, but the detection fails to detect unforeseen combinations and new types of malicious codes
Solution Approach 1:
The patent changes the detection parameter from static signature matching to dynamic behavior analysis. Instead of comparing fixed signature patterns, the system monitors system call sequences, argument patterns, and execution behaviors to detect malicious codes, enabling detection of both known and unknown attack types through behavioral characteristics
Solution Approach 2:
The patent replaces the mechanical signature-matching mechanism with a behavior analysis mechanism. The system call monitor module intercepts and analyzes actual system call behaviors, substituting the rigid signature comparison approach with a more flexible behavior-based detection system that can adapt to new attack patterns
2Adaptability or versatility
If conventional IDS expands the signature database to cover more attack types, then the detection coverage increases, but the signature database size explodes and maintenance becomes difficult
Solution Approach 1:
The patent extracts the detection logic from the signature database itself and relocates it to behavior analysis rules. Instead of storing extensive signature data, the system extracts key behavioral characteristics and detection rules that can identify malicious patterns without requiring large signature databases
Solution Approach 2:
The patent creates a virtual model of normal system behavior through system call monitoring and comparison. By copying and analyzing the expected behavior patterns, the system can detect deviations without needing exhaustive signature databases, using behavioral modeling instead of signature storage
3Measurement precision
If the system monitors all system calls to detect malicious codes, then the detection accuracy improves, but the system performance overhead increases
Solution Approach 1:
The patent applies partial monitoring by focusing on specific system calls and behavioral patterns that are most indicative of malicious activity. Instead of analyzing every system call in detail, the system monitors key calls and uses heuristic rules to identify suspicious patterns, reducing overhead while maintaining detection accuracy
Solution Approach 2:
The patent performs preliminary filtering by establishing baseline behavior patterns before actual detection. The system pre-defines detection rules and thresholds based on normal behavior, allowing it to quickly evaluate system calls against these pre-established criteria without requiring complex real-time analysis of every call
Data Source
AI summary
A detecting method and architecture thereof for malicious codes is provided, which is applicable to a computer system having at least a host. Each host executes at least a process. The method is implemented with a system call interposition module and an analysis module for malicious codes. The system call module intercepts all system calls of process calls and all related arguments of the system calls. The analysis module for malicious codes analyzes the input data of pre-determined system calls, and executes the suspicious malicious codes. Once the same behaviors between the analysis module and the suspicious malicious codes are found, a system-intrusion warning is immediately triggered. The method is not required to maintain huge signature databases, and can detect unknown attack-skills in a manner of high correct rate and low incorrect ruling.