Executable Code Vulnerability Detection and Healing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing technologies fail to effectively detect and prevent vulnerabilities in computer code before they are compromised, especially in embedded systems that control critical infrastructure, leading to potential drastic consequences from attacks.
Innovation Solution
The process involves static analysis to identify vulnerability points and paths in executable code, generating customized healing templates that can be inserted at runtime to inhibit attacks, using techniques like address space layout randomization and dynamic caller-callee convention adjustments to create a unique memory layout that breaks attackers' assumptions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static analysis is performed to identify vulnerability points in executable code, then vulnerability detection capability is improved, but analysis time and computational resources increase
Solution Approach 1:
The patent performs static analysis and identifies vulnerability points during the compilation phase before the executable code is deployed. By conducting the analysis in advance and generating healing templates beforehand, the system avoids time-consuming analysis during runtime, thus improving vulnerability detection capability while minimizing analysis time impact on system operation.
2Reliability
If healing templates are inserted into executable code to prevent attacks, then system security is improved, but code size and performance overhead increase
Solution Approach 1:
The patent extracts and separates the healing logic into standalone healing templates that are inserted only at specific vulnerability points in the executable code. Rather than adding security checks throughout the entire codebase, the system selectively places minimal healing code only where vulnerabilities exist, thus improving security while minimizing the increase in code size and performance overhead.
Solution Approach 2:
The healing templates are designed as lightweight, minimal code snippets that are inserted temporarily at vulnerability points. These templates perform their security function and can be removed or deactivated once the vulnerability is addressed, minimizing the permanent impact on code size and system complexity.
3Object-affected harmful factors
If address space layout randomization is implemented to break attackers' assumptions, then attack resistance is improved, but memory management complexity increases
Solution Approach 1:
The patent implements address space layout randomization that dynamically changes the memory layout between different executions of the same program. By making the memory layout dynamic and unpredictable, the system breaks attackers' assumptions about fixed memory addresses, thereby improving attack resistance. The system manages this complexity through compiler-level abstractions that handle the randomization automatically.
Data Source
AI summary
An example process includes: identifying, by one or more processing devices, candidate code in executable code based on a static analysis of the executable code, where the candidate code includes code that is vulnerable to attack or the candidate code being on a path to code that is vulnerable to attack, where information related to the attack is based, at least in part, on the candidate code; customizing, by one or more processing devices, a healing template based on the information to produce a customized healing template; and inserting, by one or more processing devices, the customized healing template into a version of the executable code at a location that is based on a location of the candidate code in the executable code, where the customized healing template includes code that is executable to inhibit the attack.