Automated Whitelist Management via Installation Script Parsing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current whitelisting methods require manual administration and updates for software suites, which is time-consuming and prone to errors, especially during software installations that involve multiple executable programs, increasing the risk of malicious programs being inadvertently added to the whitelist.
Innovation Solution
A system that analyzes installation scripts to automatically manage whitelists by adding and removing entries for programs installed, modified, or deleted during software installations, ensuring only authorized programs are executed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual whitelisting administration is used for software suites, then security control is maintained, but administration time and error risk increase significantly
Solution Approach 1:
The system performs preliminary actions by automatically analyzing the installation script before the software suite is fully installed, identifying all executable programs that will be created, and pre-populating the whitelist with these programs. This eliminates the need for manual post-installation whitelist updates, resolving the contradiction between maintaining security control and reducing administration time.
Solution Approach 2:
The system enables self-service by allowing the installation script itself to provide the information needed for whitelist population. The anti-malware software automatically extracts executable program names from the installation script without human intervention, making the whitelist maintenance process self-sufficient and eliminating manual administration entirely.
2Manufacturing precision
If manual scanning of directories is performed to identify executables, then whitelist completeness may be achieved, but accuracy decreases due to potential inclusion of malicious programs
Solution Approach 1:
The installation script serves as an intermediary that provides authoritative information about which programs are legitimate. Instead of scanning directories and relying on heuristics to distinguish malicious from legitimate programs, the system uses the installation script as a trusted source to automatically populate the whitelist, eliminating the need for manual verification and preventing malicious programs from being added.
Solution Approach 2:
The system uses feedback from the installation script to automatically update the whitelist. The anti-malware software monitors the installation process, extracts executable information from the script, and automatically adds these programs to the whitelist. This closed-loop feedback mechanism ensures accuracy without manual intervention, resolving the contradiction between completeness and accuracy.
3Adaptability or versatility
If comprehensive directory scanning is performed to ensure all programs are whitelisted, then whitelist completeness improves, but processing time and complexity increase
Solution Approach 1:
The system extracts only the necessary information (executable program names) directly from the installation script, rather than performing comprehensive directory scanning. This extraction approach achieves whitelist completeness by capturing all legitimate executables that will be installed, while avoiding the complexity of manual directory exploration and program identification.
Solution Approach 2:
The system performs the whitelist population action preliminarily, during or immediately after the installation process, by automatically parsing the installation script. This preliminary action ensures that all required programs are whitelisted before the system goes into use, achieving completeness without the need for complex post-installation scanning and manual verification procedures.
Data Source
AI summary
A system and method of synchronizing a whitelist with an installation on a protected device includes detecting an installation and determining which programs are affected by the installation by parsing an installation file. Programs that are being installed by the installation are added to the whitelist; Programs that are being deleted by the installation are removed from the whitelist; and programs that are being modified by the installation are updated in the whitelist. Therefore, after the installation is complete, the whitelist contains entries that will allow execution of programs (executables, scripts, macros, etc.) that were installed by the installation.