Automated Code Lockdown to Reduce Software Attack Surface
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cybersecurity technologies are ineffective in locking down instructions of computer applications to prevent malware injection and execution, as they fail to identify and correlate attempts to access locked-down code before malicious intent is carried out, allowing malware to adapt and evade detection.
Innovation Solution
A method and system that determine and disable unused instructions of a computer application by performing functional and negative testing, reorganizing and randomizing them in memory, and writing memory addresses to a table for hardware processor loading, thereby changing unused instructions to inoperative to prevent execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If cybersecurity products monitor and detect malicious behavior in applications, then detection capability is improved, but malware can adapt by waiting longer to execute malicious intent, reducing detection effectiveness
Solution Approach 1:
The patent applies preliminary action by locking down unused instructions before malware can execute. The system identifies and disables unused code segments in advance, creating a protective barrier that prevents malware injection regardless of when the malicious code attempts to execute. This proactive approach eliminates the waiting period that malware relies on to adapt and evade detection.
2Adaptability or versatility
If all instructions in a computer application are left enabled, then application functionality is preserved, but the attack surface increases, allowing more points for malware injection
Solution Approach 1:
The patent applies local quality by selectively disabling only the unused instructions while leaving the used instructions enabled. The system analyzes the application to identify which code segments are actually executed and which are not, then applies the lockdown property only to the unused segments. This localized approach reduces the attack surface without affecting the functionality that users actually interact with.
3Measurement precision
If cybersecurity technologies attempt to trace and correlate access attempts to locked down code, then malware detection accuracy is improved, but the system complexity increases
Solution Approach 1:
The patent applies the taking out principle by extracting the tracking and correlation functionality from the lockdown mechanism itself. The system separates the instruction locking function from the malware detection function, allowing the lockdown to operate independently while simplifying the overall system architecture. This extraction reduces complexity while maintaining the ability to detect malware attempts.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
In an example embodiment, a system determines a set of instructions from the available instructions for a computer application. The determined set of instructions provides specific functionality of the computer application. The system may determine the set of instructions by performing functional testing and negative testing on the specific functionality. The system may reorganize and randomize the set of instructions in memory and write the reorganized set of instructions to a smaller memory space. For each available instruction not in the set of instructions, the system changes the respective instruction to inoperative to prevent execution of the respective instruction. The system may change the respective instruction to inoperative by overwriting the instruction with a NOP instruction. The system then captures a memory address of the computer application being accessed at runtime. The system may declare a security attack if the captured memory address matches a memory address for an inoperative instruction.