Software Update Sandbox for Signed Package Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing anti-virus (AV) and advanced persistent threat (APT) defenses are ineffective against software supply chain attacks, as software update packages from trusted vendors are digitally signed and large in size, evading detection and installation without exhibiting malicious behavior.
Innovation Solution
Implement a software update sandbox that intercepts and installs software updates, monitoring their behavior during unpacking, installation, and post-installation to detect and prevent malicious activities, regardless of file size or type, applying a zero-trust policy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based anti-virus software is used to detect malicious software, then known threats can be detected, but software supply chain attacks delivered via digitally signed software updates cannot be stopped
Solution Approach 1:
The system performs preliminary analysis of software updates by extracting and analyzing components before installation, creating a behavioral baseline. This preliminary action allows the system to detect malicious behavior patterns in advance, preventing supply chain attacks before they can execute on the target system.
Solution Approach 2:
The patent introduces an intermediary analysis layer that sits between the software update delivery and installation processes. This intermediary component performs behavioral analysis on extracted update components without requiring full installation, acting as a mediator that blocks malicious updates while allowing legitimate ones to proceed.
2Speed
If software updates are automatically distributed and installed to ensure rapid security patches, then system security is improved, but the risk of undetected malware installation increases
Solution Approach 1:
The system performs preliminary behavioral analysis of update components before automatic installation, extracting key components and analyzing their behavior patterns in advance. This preliminary action enables rapid detection of malicious updates while maintaining automated deployment speed for legitimate updates.
Solution Approach 2:
The patent implements preliminary anti-action by proactively analyzing software update behavior and blocking malicious updates before they can be installed. The system takes counter-measures in advance by detecting suspicious behavioral patterns and preventing the installation of compromised updates, thus neutralizing the threat before it can affect the system.
3Productivity
If AV software is size-limited to assume attackers won't construct large malware files, then analysis efficiency is maintained, but large software update packages containing malicious components cannot be properly analyzed
Solution Approach 1:
The system segments large software update packages into individual components or modules for analysis. By dividing the update package into extractable components, the system can analyze each component's behavior separately without being overwhelmed by the total size, maintaining analysis efficiency while handling large update packages.
Solution Approach 2:
The patent extracts key components and binaries from large software update packages for focused behavioral analysis. By taking out only the critical executable components rather than analyzing the entire update package, the system maintains high analysis efficiency while effectively detecting malicious components within large legitimate updates.
4Reliability
If software updates are delivered through trusted vendors with digital signatures, then authenticity is verified, but malicious components can be hidden inside legitimate signed packages
Solution Approach 1:
The system performs preliminary behavioral analysis of update components before installation, extracting and analyzing the behavior of individual components within the signed package. This preliminary action reveals malicious behavior patterns that are hidden within legitimately signed updates, enabling detection without compromising the authenticity verification of the overall package.
Solution Approach 2:
Instead of trusting the digital signature and assuming the entire package is safe, the patent inverts the approach by analyzing the behavior of individual components within the signed package. This inversion allows the system to detect malicious components hidden inside legitimate signed updates by examining component behavior rather than relying solely on package-level authentication.
Data Source
AI summary
A new approach is proposed to support software update verification and malicious behavior detection. When a software update package is being delivered by a software vendor to an intended recipient, a software update registry intercepts the software update package and installs the software update on a software update sandbox regardless of the size of the software update package. All behaviors of the software update during unpacking, installation, and post-installation operations are monitored and analyzed by the software update sandbox to verify that there is no malicious behavior or component in the software update package. If the software update is verified to be safe, then the software update package is delivered to the intended recipient for installation. If the software update is determined to be unsafe, then the software update will be blocked.