Zero Trust Kernel Agent for Memory Code Integrity Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional endpoint detection and response (EDR) solutions are ineffective against new and polymorphic malware due to delays in updates and inability to detect attacks starting in memory via legitimate processes, leading to vulnerabilities and false negatives.
Innovation Solution
A zero-trust (ZT) system that uses trust binaries to validate executable code by creating function digests and hashing headers, requiring a corresponding trust binary for execution, and employs a kernel agent to monitor memory operations and verify code integrity, blocking untrusted binaries and detecting attacks in real-time.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional EDR solutions are used to detect and stop known attacks, then detection capability for known malware is improved, but response time to new attacks increases significantly due to update delays
Solution Approach 1:
The system performs preliminary validation by creating trust binaries and function digests for legitimate code before execution. When code is loaded into memory, the trust agent proactively validates it against the trust binary database, establishing a baseline of expected behavior before attacks can occur. This preliminary action eliminates the need to wait for update cycles to detect new threats.
Solution Approach 2:
Instead of detecting malware by identifying known attack patterns (conventional approach), the system inverts the approach by validating code against a trust binary database of legitimate code. The trust agent compares running code against expected trust binaries, allowing detection of new and polymorphic malware by identifying deviations from legitimate code behavior, rather than relying on update cycles for new threat signatures.
2Measurement precision
If conventional EDR solutions update detection signatures regularly, then detection accuracy for known threats is improved, but the system remains vulnerable during update cycles to new and polymorphic malware
Solution Approach 1:
The trust binary database contains function digests for legitimate code that are continuously validated against running processes. Rather than periodic updates, the system maintains continuous validation capability by comparing code in memory against the trust binary database in real-time, eliminating vulnerability periods during update cycles. The trust agent continuously monitors and validates code, ensuring detection accuracy remains high without interruption.
3Reliability
If the ZT system validates all code against trust binaries, then protection against new threats is improved, but system complexity increases due to memory monitoring and validation procedures
Solution Approach 1:
The system extracts only the essential validation functionality into a dedicated trust agent that operates independently from the main operating system. The trust agent is responsible for creating trust binaries, validating code against the trust binary database, and enforcing security policies. This extraction of validation functions into a separate component simplifies the overall system architecture while maintaining comprehensive protection, as the trust agent handles all validation operations without requiring complex integration throughout the entire system.
4Reliability
If the ZT system monitors memory operations in real-time, then detection of attacks starting in memory is improved, but processing overhead and system performance decrease
Solution Approach 1:
The system replaces complex mechanical analysis of code behavior with cryptographic hash-based validation. Instead of analyzing code execution patterns, control flow, or behavioral characteristics in real-time, the trust agent uses function digests (cryptographic hashes) to efficiently validate code against trust binaries. This substitution of cryptographic verification for behavioral analysis dramatically reduces processing overhead while maintaining reliable detection of attacks starting in memory, as hash comparison is computationally efficient compared to behavioral analysis.
Data Source
AI summary
The various implementations described herein include methods and devices for creating and using trust binaries and blockchains. In one aspect, a method includes accessing a trust store for the computing device, including obtaining a blockchain for the trust store. A first change to the trust store is identified. In response to identifying the first change, a first block is generated and inserted into the blockchain, where the first block includes a first encrypted digest for the first change and a first block digest. A second change to the trust store is identified. In response to identifying the second change, a second block is generated and inserted into the blockchain, where the second block includes a second encrypted digest for the second change, a second block digest, and the first block digest.