Trust Binary Validation for Executable Functions Against Unknown Malware
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional endpoint detection and response (EDR) solutions are ineffective against new and polymorphic malware, leading to significant delays in detection and increased vulnerability due to their reliance on past trends and inability to handle unknown threats.
Innovation Solution
A zero trust (ZT) system that uses trust binaries to validate executable code by comparing it with a trust binary database, ensuring authenticity and preventing unauthorized execution, implemented with a trust agent that monitors memory operations and verifies code integrity using function digests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional EDR solutions are used to detect and stop known attacks, then detection capability for known threats is improved, but response time increases significantly due to delays in updating detection signatures
Solution Approach 1:
The system creates a trust binary in advance by identifying code segments, scanning for executable functions, generating function digests, and combining them into a trust binary before the executable code is actually run. This preliminary creation of the trust binary eliminates the need for real-time analysis during execution, thus reducing response time while maintaining detection capability.
Solution Approach 2:
The executable code is divided into code segments, and further segmented into individual executable functions. Each function is analyzed separately to generate a function digest, which is then combined into the trust binary. This segmentation allows for efficient processing and validation of individual functions rather than analyzing the entire executable at once.
2Measurement precision
If conventional EDR solutions rely on past trends and known attack patterns, then detection accuracy for known malware is improved, but effectiveness against new and polymorphic malware deteriorates
Solution Approach 1:
Instead of relying on detection signatures or heuristics that must be updated for new threats, the system creates a trusted copy (trust binary) of the executable code's functional characteristics. This trust binary serves as a reference that can validate the integrity of the code at runtime, providing adaptability to new and polymorphic malware while maintaining detection accuracy through cryptographic verification.
3Reliability
If real-time validation of executable code is implemented, then protection against unauthorized code is improved, but system performance deteriorates due to continuous monitoring overhead
Solution Approach 1:
The trust binary is created in advance before the executable code needs to be validated at runtime. This preliminary preparation includes identifying code segments, scanning for functions, generating digests, and combining them into the trust binary. By doing this work beforehand, the runtime validation process is minimized to simple comparisons, thus maintaining protection effectiveness while reducing performance overhead.
Data Source
AI summary
The various implementations described herein include methods and devices for creating and using trust binaries. In one aspect, a method includes executing a trust agent and detecting, via the trust agent, upcoming execution of a program. In response to the detection, a trust binary for the program is obtained from a trust store and authenticity of the program is confirmed by comparing executable code of the program with the obtained trust binary. Execution of the program is allowed in accordance with the confirmed authenticity. The method also includes identifying upcoming execution of a function in the program by monitoring execution of the program and obtaining, from the trust binary, a function digest corresponding to the function. Authenticity of the function is confirmed by comparing executable code of the function with the obtained function digest. Execution of the function is allowed in accordance with the confirmed authenticity.