Untrusted Code Monitoring for Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The use of third-party software packages in computing systems introduces security vulnerabilities due to the lack of comprehensive review, making them susceptible to unknown security threats and exploits, even when best security practices are employed.
Innovation Solution
Implementing a monitoring service that profiles the behavior of untrusted code during a learning period and compares it to expected behavior, allowing for the detection of suspicious activities, and a wrapping application that reduces privileges of untrusted code by executing it in a separate process with reduced privileges, thereby mitigating potential attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If third-party software packages are used to speed up development, then productivity is improved, but security reliability deteriorates due to unknown vulnerabilities and lack of comprehensive review
Solution Approach 1:
The system performs preliminary actions by monitoring and profiling the behavior of third-party software packages during a learning period before they are fully deployed. This allows the system to establish a baseline of expected behavior and detect anomalies that indicate security vulnerabilities or malicious code, thereby maintaining security reliability while still using third-party packages for productivity.
Solution Approach 2:
The patent introduces a monitoring service as an intermediary between the third-party software packages and the host system. This intermediary continuously observes package behavior, compares it against expected patterns, and can block suspicious activities. This allows the system to maintain productivity by using third-party packages while the intermediary protects against security risks.
2Reliability
If comprehensive review of every imported package is performed to ensure security, then security reliability is improved, but device complexity and time consumption increase
Solution Approach 1:
The system implements self-service by enabling third-party packages to be automatically monitored and evaluated against their declared functionality. The monitoring service automatically profiles package behavior, compares it to expected patterns, and identifies discrepancies without requiring manual review. This maintains security reliability while avoiding the complexity and time consumption of comprehensive manual reviews.
Solution Approach 2:
The patent replaces the mechanical process of manual code review with an automated electronic monitoring system. Instead of humans manually examining package code and behavior, the system uses automated profiling, pattern matching, and anomaly detection algorithms. This substitution maintains security reliability while dramatically reducing the complexity and time required for package review.
3Reliability
If monitoring and profiling of untrusted code is implemented to detect suspicious behavior, then security reliability is improved, but device complexity increases
Solution Approach 1:
The monitoring service implements local quality by focusing surveillance on specific, high-risk operations rather than monitoring all code execution uniformly. It profiles and monitors privileged operations such as file access, network connections, and system calls that are most likely to indicate malicious behavior. This targeted approach maintains security reliability while reducing the overall complexity of the monitoring system compared to comprehensive total observation.
Data Source
AI summary
Disclosed are various embodiments for detecting unknown software vulnerabilities and system compromises. During a learning period in which execution of a software package is monitored, invoked portions of the software package are determined. Also, during learning period, a frequency of use of at least one of the invoked portions of the software package is determined. It is determined that the frequency of use during the learning period is different from a frequency of use after the learning period, and in response, an action is performed.