Code Permutation for Malicious Software Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for preventing malicious software execution in computer systems are inadequate, as they can be bypassed by compression or encryption, and behavior blocking mechanisms often make sub-optimal decisions, allowing harmful programs to execute while blocking harmless ones.
Innovation Solution
A permutation is performed on a subset of instructions within an application program to create a permuted sequence, which is stored in a permuted instruction pointer table and executed in an execution module capable of translating it into machine code, ensuring that only cross-compiled code can be executed, thereby preventing unauthorized software execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If simple detection techniques such as scanning for a search string are used, then detection ease is improved, but detection reliability deteriorates because the process can be easily subverted by converting malicious code via compression or encryption
Solution Approach 1:
The patent applies preliminary action by performing code permutation and cross-compilation on application programs before they are executed in the insulated environment. This pre-transformation ensures that even if malicious code is present, it cannot execute harmful actions because it has already been transformed into a different instruction set that maintains functional equivalence but prevents direct malicious execution
Solution Approach 2:
The patent uses an intermediary approach by introducing a cross-compiler and permutation mechanism as a mediator between the original application program and the insulated environment. The cross-compiler translates code from one instruction set to another, creating a layer of indirection that prevents direct execution of malicious code while preserving legitimate functionality through the translation layer
2Measurement precision
If behavior blocking mechanisms are used to intercept malicious actions during program execution, then detection capability is improved, but false positive rate increases leading to sub-optimal blocking decisions where harmless programs are blocked while harmful programs are allowed to execute
Solution Approach 1:
The patent applies preliminary anti-action by preventing malicious code from executing harmful actions in the first place, rather than attempting to detect and block them during execution. By transforming the code through cross-compilation and permutation before execution in the insulated environment, the system proactively neutralizes potential malicious behavior before it can cause harm, eliminating the need for reactive blocking decisions
Solution Approach 2:
The patent segments the execution environment into an insulated sandbox that isolates application programs from the host system. This segmentation allows the system to execute transformed code in a controlled environment where even if malicious behavior occurs, it cannot affect the host system, thereby improving both detection capability and decision accuracy without risking false positives
3Reliability
If emulation is used to execute suspect code within an insulated environment, then system protection is improved, but the emulation environment itself becomes vulnerable to virus attacks and data infection leading to a break in isolation
Solution Approach 1:
The patent replaces the traditional emulation approach with a cross-compilation mechanism. Instead of emulating instructions in software, the system uses a cross-compiler to translate code from one instruction set to another, creating native machine code for the target architecture. This substitution eliminates the vulnerability inherent in software emulation while maintaining the ability to execute code in an insulated environment
Solution Approach 2:
The patent applies preliminary action by performing cross-compilation and code transformation before execution, rather than relying on runtime emulation. This pre-processing step creates a transformed version of the code that is functionally equivalent but structurally different, preventing viruses from exploiting emulation vulnerabilities while maintaining system protection
Data Source
AI summary
A method for preventing malicious software from execution within a computer system is disclosed. A permutation is performed on a subset of instructions within an application program to yield a permuted sequence of instructions before any actual execution of the application program on the computer system. A permutation sequence number of the permuted sequence of instructions is stored in a permuted instruction pointer table. The permuted sequence of instructions is executed in an execution module that is capable of translating the permuted sequence of instructions to an actual machine code of a processor within the computer system according to the permutation sequence number of the permuted sequence of instructions stored in the permuted instruction pointer table.