Compiler Function Call Stack Probes for Forensic Data Reduction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing forensic data collection tools generate overwhelming volumes of data, particularly in IoT systems, with similar attack patterns repeated across devices, making rapid response analysis difficult and failing to effectively identify unique attack vectors and vulnerabilities.
Innovation Solution
A novel compiler inserts probes into executable code to generate function call graphs and behavior models during compile time, allowing for efficient identification of attack call stacks and prevention through hash-based thumbprint matching, enabling focused forensic data analysis and real-time attack detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If traditional forensic data collection tools are used to capture comprehensive data during attacks, then detailed information about execution and resources is obtained, but the volume of forensic data becomes overwhelming and difficult to analyze rapidly
Solution Approach 1:
The patent extracts only the critical function call stack information from the broader forensic data context. By focusing specifically on function call stacks rather than collecting all possible execution data, the system obtains essential attack information while dramatically reducing the overall data volume that needs analysis.
Solution Approach 2:
The patent segments the forensic data collection process into two phases: automatic collection of function call stack data during attacks, and manual analysis of only the extracted stack information. This segmentation allows comprehensive data capture during execution while limiting manual analysis to only the most relevant portions.
2Loss of information
If comprehensive forensic data is collected from IoT systems with hundreds or thousands of devices, then complete attack information is obtained, but the complexity and volume of data makes rapid response analysis difficult
Solution Approach 1:
The patent extracts only the function call stack information which contains the essential attack sequence data. This extraction approach maintains complete attack information while eliminating the complexity of analyzing all possible execution data from hundreds or thousands of IoT devices.
Solution Approach 2:
The function call stack collection mechanism works universally across all IoT devices regardless of their specific operations or data types. By using a unified approach to capture function call stacks, the system handles diverse attack scenarios across multiple devices without increasing analysis complexity.
3Reliability
If similar attack patterns are collected from multiple IoT devices, then comprehensive security coverage is achieved, but the repetition of similar data patterns makes it difficult to identify unique vulnerabilities
Solution Approach 1:
The patent extracts and focuses specifically on function call stack sequences, which naturally highlight unique attack patterns. By isolating the function call sequences rather than analyzing all execution data, similar patterns across devices become easily comparable while unique vulnerabilities stand out through their distinct call stack signatures.
Solution Approach 2:
The patent applies local quality analysis by examining specific function call stack sequences individually. Each attack's function call stack is analyzed as a unique pattern, allowing detailed examination of local variations in attack methods while maintaining the ability to identify broader commonalities across devices.
Data Source
AI summary
A novel compiler is described. The compiler is able to view source code of the application in its entirety and can do so from the inside. Unlike other tools which examine the forensic data from an application crash after the fact, from the outside, the compiler of the present invention can provide novel data on function call stacks and function profiles during runtime. The application may be stopped immediately during runtime to prevent further or potential damage, but the forensic data that is collected is focused and can be used to show where vulnerabilities exists in the application and how they were exploited. Hashes are taken of function call stacks and used as unique identifiers or thumbprints which can be used to reduce the volume of forensic data that needs to be analyzed after an attack.