User Space Data Tracking for Encrypted Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current intrusion detection systems (IDS) are limited in detecting threats from encrypted data packets, as they often lack access to decryption keys and struggle with tracking encrypted data flows, leading to blind spots in host-based systems and inefficiencies in Deep Packet Inspection methods.
Innovation Solution
The system dynamically instruments user code to mark memory locations containing data from untrusted sources, allowing for tracking and analysis of data flows, even when encrypted, by injecting instrumentation code to monitor data access and storage locations, and feeding this information to a threat detection engine for signature analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If Deep Packet Inspection is used to inspect encrypted data packets, then detection capability is improved, but system performance deteriorates due to decryption overhead and key management requirements
Solution Approach 1:
The patent extracts only the necessary portions of encrypted data (headers, metadata, specific fields) for inspection without requiring full decryption. This selective extraction approach maintains detection capability while avoiding the performance overhead of decrypting entire data packets.
Solution Approach 2:
The inspection process is segmented into targeted analysis of specific data portions (headers, metadata, selected fields) rather than inspecting the entire encrypted packet. This segmentation allows the system to focus computational resources on critical areas that indicate threats without processing the full encrypted payload.
2Reliability
If signature-based detection is used to scan all data packets, then threat detection is improved, but processing speed deteriorates due to comprehensive scanning requirements
Solution Approach 1:
The patent applies signature-based detection selectively to specific portions of data packets (headers, metadata, unencrypted fields) rather than scanning the entire packet content. This localized application of detection algorithms maintains threat detection reliability while significantly improving processing speed by avoiding comprehensive scanning of encrypted payloads.
3Loss of information
If encrypted data flows are tracked without decryption keys, then privacy protection is improved, but detection accuracy deteriorates due to inability to analyze encrypted content
Solution Approach 1:
The patent performs preliminary tracking and marking of memory locations containing encrypted data flows before decryption occurs. By establishing the data footprint and movement patterns in advance, the system maintains privacy protection while creating a framework for subsequent detection analysis that does not require full decryption of the encrypted content.
Data Source
AI summary
A way to track data from an untrusted source as it moves through memory in original or modified form. A probe is placed on a data reception call of a program. When the probe is triggered by execution of the data reception call for a piece of data, a location where the piece of data is to be stored is marked. When a program instruction requests access to the marked location, instrumentation code is injected subsequent to the program instruction to track the flow of the piece of data. When the instrumentation code is executed, the next location where the piece of data will be stored is determined and marked as well. A threat analyzer is invoked to analyze the marked locations for threats.