Cross-compiled Code Permutation for Malicious Software Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for preventing malicious software execution in computer systems are inadequate, as they can be bypassed by compression or encryption, and behavior blocking mechanisms often make sub-optimal decisions, allowing harmful programs to execute while blocking harmless ones.
Innovation Solution
The method involves cross-compiling application programs into a set of cross-compiled code, which is then executed in an execution module capable of recognizing and translating this code into machine code, ensuring that only properly installed and transformed programs can run, using a permutation algorithm to create unique instruction sets that protect the machine level of the computer system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If simple detection techniques such as scanning for search strings are used, then detection process is simple and fast, but malicious code can be bypassed by compression or encryption
Solution Approach 1:
The patent introduces an intermediary component (the transformation module with permutation algorithm) between the application program and the execution environment. This intermediary transforms the original code into a permuted form that cannot be easily detected by simple scanning, yet can be executed correctly through the translation module, thus resolving the contradiction between fast detection and reliable detection
Solution Approach 2:
The patent changes the parameter representation of the code by applying permutation algorithms that reorder instructions and change the structure of the code. This transformation maintains the functional equivalence of the program while making it undetectable by traditional string-based scanning methods, thereby improving detection reliability without sacrificing speed
2Reliability
If behavior blocking mechanism is used to intercept malicious actions, then some malicious software can be detected, but harmless programs may be blocked and harmful programs may be allowed to execute
Solution Approach 1:
The patent applies preliminary transformation to the code before execution by using permutation algorithms to reorder instructions and transform the code structure. This preliminary action ensures that the transformed code maintains its original functionality while being protected from misclassification by behavior blocking mechanisms, thus improving execution accuracy without compromising detection reliability
3Object-affected harmful factors
If emulation is used to execute suspect code in an insulated environment, then computer system is protected from malicious actions, but the emulation environment itself is not protected and data can be infected
Solution Approach 1:
The patent extracts the harmful potential from the code by transforming it into a permuted form that cannot execute malicious actions in the traditional sense. The transformation module separates the code analysis function from the execution function, allowing the system to evaluate code safety without creating a vulnerable emulation environment, thus maintaining isolation environment integrity while providing protection
Data Source
AI summary
A method for preventing malicious software from execution within a computer system is disclosed. Before any actual execution of an application program on a computer system, the application program needs to be cross-compiled to yield a set of cross-compiled code of the application program. The set of cross-compiled code of the application program can then be executed in an execution module that is capable of recognizing and translating the set of cross-compiled code of the application program to the actual machine code of the processor.