Wrapper Executable for Suspicious Process Regulation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The security industry faces challenges in effectively addressing malware threats due to the increasing sophistication of malware and the limitations of traditional detection methods, leading to a disconnect between behavioral detection and appropriate follow-on actions, particularly when there is reasonable but not conclusive evidence of malicious intent.
Innovation Solution
A system that regulates the execution of potentially suspicious processes by encrypting and wrapping files associated with them, allowing controlled execution in a virtual machine or other environment, enabling safe analysis and decision-making through a wrapper that mimics the original file's location and functionality, while securely managing encryption keys and user intervention.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional malware detection methods (signatures, heuristics) are used, then detection capability is maintained, but the system cannot effectively address increasingly sophisticated malware threats
Solution Approach 1:
The patent introduces a wrapper executable as an intermediary layer between the suspicious file and the operating system. This wrapper mediates the execution by intercepting system calls, monitoring behavior, and controlling what the suspicious file can access, thereby enabling safe analysis of sophisticated malware without direct exposure to the host system.
Solution Approach 2:
The system segments the execution environment by separating the suspicious file from the host operating system through the wrapper layer. This creates an isolated execution context where the suspicious code runs in a controlled environment, allowing analysis while preventing direct harmful interactions with the host system.
2Reliability
If a suspicious process is automatically blocked or deleted, then immediate protection is provided, but legitimate software may be incorrectly blocked (false positives)
Solution Approach 1:
The wrapper acts as a mediator that provides a controlled interface for analyzing suspicious files. Instead of immediately blocking or deleting, the wrapper allows the suspicious file to execute in a monitored environment, enabling observation of behavior patterns that can distinguish legitimate software from malware, thereby reducing false positives while maintaining security.
Solution Approach 2:
The system implements feedback mechanisms where the wrapper monitors system calls, file access patterns, and execution behavior of the suspicious file, feeding this information back to the analysis system. This continuous feedback loop enables dynamic decision-making about whether to block, delete, or allow execution based on observed behavior rather than static signatures.
3Measurement precision
If a suspicious process is monitored at the kernel level, then detailed behavior analysis is achieved, but system complexity and performance overhead increase
Solution Approach 1:
The wrapper executable serves as an intermediary that simplifies the monitoring architecture by running at a higher level (user mode rather than kernel mode). It captures system call information and execution behavior, reducing the complexity of kernel-level monitoring while maintaining detailed observational capabilities. The wrapper handles the complexity of interaction with the host system, isolating monitoring functions from the core OS.
4Reliability
If the suspicious file is executed in a virtual machine, then safe analysis is enabled, but execution speed and analysis time are reduced
Solution Approach 1:
The wrapper provides a lightweight intermediary execution layer that sits between the suspicious file and the host OS, offering safer execution without requiring full virtual machine overhead. By implementing a simplified monitoring and control mechanism rather than complete virtualization, the system achieves safe analysis while minimizing performance penalty.
Data Source
AI summary
There is disclosed a method, computer program product and a system for regulating execution of a suspicious process, comprising determining a file system location of an executable file associated with the suspicious process, encrypting the file, and creating a wrapper for the file with the same file name and location as the file associated with the suspicious process.