Data Value Alteration Model for Shellcode Disarming
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques are inadequate in detecting and preventing malicious shellcode attacks, particularly zero-day exploits, as they rely on signature-based detection and behavior monitoring, which fail to identify new or encoded shellcode embedded in legitimate files, and are ineffective against sophisticated evasion techniques.
Innovation Solution
A method and system that automatically apply a data value alteration model to input content to render malicious code inactive without relying on malware detection algorithms, altering select data values to disrupt the execution of shellcode, thereby preventing its intended malicious purpose regardless of the file structure or format.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection and behavior monitoring are used to detect malicious shellcode, then known malware can be identified, but new or encoded shellcode (zero-day exploits) cannot be detected
Solution Approach 1:
The patent applies data value alteration to transform the parameters of the content, specifically modifying byte-level data values to disrupt shellcode execution. By changing data values in the content (such as image pixel values or audio sample values), the system renders malicious shellcode inactive while preserving the legitimate functionality and human-perceptible quality of the content.
2Reliability
If malware detection algorithms are applied to detect shellcode, then malicious content can be identified, but the detection process is computationally intensive and may miss encoded variants
Solution Approach 1:
The patent applies data value alteration as a preliminary protective action before the content is processed by vulnerable applications. By proactively modifying the content to disarm shellcode, the system prevents malicious execution without requiring complex real-time detection algorithms during content processing.
3Reliability
If content is modified to disarm shellcode, then malicious code is rendered inactive, but the content structure and format must be preserved for usability
Solution Approach 1:
The patent applies data value alteration selectively to specific bytes or bits within the content that are likely to contain shellcode, while preserving the overall content structure and format. This localized modification approach disarms malicious code while maintaining the legitimate functionality and human-perceptible quality of the content.
Data Source
AI summary
The disclosed embodiments include a method of disarming malicious code in a computer system having a processor. The method comprises receiving, by the computer system, input content, and rendering, by the processor, any malicious code included in the input content inactive for its intended malicious purpose without applying a malware detection algorithm to the input content. The rendering is performed by automatically applying, using the processor, a data value alteration model to the input content for altering select data values within the input content, and outputting a new content reflecting the application of the data value alteration model to the input content. The processor renders any malicious code included in the input content inactive for its intended malicious purpose without regard to any structure used to encapsulate the input content. The input content includes media content.