Update Legitimacy Verification via Threshold-Based Whitelisting
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing application whitelisting concept faces challenges during automatic updates, where new executable files are not initially listed, leading to blocked updates and potential security risks if accepted unconditionally.
Innovation Solution
A detection system comprising an update management server and update detectors that verify the legitimacy of updates by generating updaters, reporting information, and determining legitimacy based on a threshold value, ensuring only legitimate updates are executed and new executable files are added to the whitelist.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application whitelisting is implemented to block unknown programs, then security is improved, but automatic updates are blocked because new executable files are not listed in the whitelist
Solution Approach 1:
The system performs preliminary actions by having update detectors pre-execute update installation packages in a controlled environment before the actual update is applied to production systems. This allows the system to verify the legitimacy of new executable files in advance, adding them to the whitelist before they are needed, thus resolving the contradiction between security and automatic updates.
Solution Approach 2:
Update detectors serve as an intermediary between the update management server and the application whitelist. These detectors execute update packages, collect information about generated executable files, and communicate this information to the update management server, which then updates the whitelist. This intermediary mechanism allows new files to be safely added to the whitelist without compromising security.
2Productivity
If new executable files are accepted unconditionally to enable updates, then automatic update is improved, but security risk increases due to potential malicious software
Solution Approach 1:
The system executes update installation packages in advance on update detectors to generate executable files before they are deployed to production. This preliminary execution allows the system to verify file legitimacy through multiple detectors and only accept files that pass verification, thus enabling automatic updates while maintaining security.
Solution Approach 2:
The system implements feedback mechanisms where update detectors report information about executed update packages and generated executable files to the update management server. The server aggregates this feedback from multiple detectors, determines legitimacy based on threshold values, and uses this information to update the whitelist, creating a closed-loop security verification system.
3Measurement precision
If multiple update detectors are used to verify updates, then legitimacy determination accuracy is improved, but system complexity increases
Solution Approach 1:
The system segments the update verification function into multiple independent update detectors that each execute update packages and report results. This segmentation allows parallel verification across multiple detectors, improving accuracy through majority voting or threshold-based determination while keeping each individual detector relatively simple in structure.
Solution Approach 2:
The system merges the verification results from multiple update detectors at the update management server level. By combining information from multiple detectors and applying threshold-based legitimacy determination, the system achieves high accuracy in identifying legitimate updates while centralizing the complexity management at the server level rather than in each detector.
Data Source
AI summary
A detection system for determining whether an update of at least one application installed on at least one whitelisted host is legitimate is provided. The system includes an update management server and update detectors installed with the application(s). During a process that software automatic update occurs in each update detector and a corresponding update installation package is executed, the executed update installation package generates at least one updater corresponding to each application. Each update detector transmits report information which includes the information of the at least one updater and sampled executable files to the update management server. The update management server obtains a number of update detectors, having performed the update operation of each application, according to the report information of each update detector. If the number is greater than or equal to a threshold value, it is determined that the update is legitimate.