Autogenous Vulnerability Detection and Healing in Computer Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems fail to effectively detect and heal vulnerabilities in computer code, particularly silent vulnerabilities like the Heartbleed vulnerability, which can lead to severe consequences in networked embedded systems, as they are difficult to detect due to lack of integrity violation and require innovative methods for characterization and exploitation prevention.
Innovation Solution
The implementation of a hybrid approach that includes static analysis to identify vulnerability points, injection of runtime support code for validation and healing, and predicated execution to prevent memory access violations, enabling autogenous detection and healing of vulnerabilities without requiring foreknowledge of specific attacks or signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static analysis is used to identify vulnerability points, then vulnerability detection capability is improved, but system complexity increases due to injection of runtime support code
Solution Approach 1:
The system performs static analysis during the compilation phase to identify vulnerability points and injects healing code before runtime. This preliminary action allows the system to prepare vulnerability detection and prevention mechanisms in advance, improving detection capability while managing complexity by doing the heavy analysis work before execution.
Solution Approach 2:
The patent introduces runtime support code as an intermediary between the original vulnerable code and the execution environment. This intermediary layer performs boundary checks and validation without fundamentally altering the original code logic, enabling vulnerability detection while maintaining a clear separation between original functionality and security mechanisms.
2Reliability
If runtime support code is injected for validation, then exploitation prevention is improved, but execution time increases due to additional boundary checks
Solution Approach 1:
The runtime support code applies boundary checks and validation only at specific vulnerability points identified during static analysis, rather than performing universal checks throughout the entire codebase. This localized approach prevents exploitation at critical locations while minimizing the impact on overall execution time by avoiding redundant checks in safe code regions.
3Object-affected harmful factors
If predicated execution is used to prevent memory access violations, then system security is improved, but code complexity increases due to conditional execution logic
Solution Approach 1:
The healing code automatically performs boundary validation and conditional execution without requiring external intervention or complex control logic. The runtime support code self-manages the validation process by checking boundaries and conditionally executing or skipping instructions based on pre-computed vulnerability information, reducing the need for additional complex control structures.
Data Source
AI summary
An example process includes identifying, by one or more processing devices, a location in computer code that is subject to vulnerability, where the location corresponds to a memory access that is repeatable and that operates on a particular type of variable; and performing processes, by one or more processing devices, to heal the vulnerability. The memory access may be part of a system-to-system or a user-to-system interaction that is repeatable.