Dynamic Program Versioning for Malware Defense
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current computer network security measures are inadequate in detecting and preventing highly sophisticated malicious software attacks, which can evade traditional antivirus systems and compromise network security by learning hardware and software structures, leading to data extraction and system disruption.
Innovation Solution
Implementing a security control module that routinely changes software applications and processing resources, using software creation tools to generate new versions quickly, and managing memory to render learned malicious software ineffective, thereby maintaining a dynamic and unpredictable environment for the attacker.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional antivirus software and security modules are used, then low to moderate sophistication attacks are detected and prevented, but highly sophisticated malicious software attacks can evade detection and compromise system security
Solution Approach 1:
The patent implements dynamic code generation where the security module creates new versions of system applications and operating system components at runtime. This dynamic transformation causes the software structure to continuously change, making it difficult for sophisticated malicious software to learn and exploit static vulnerabilities. The code generation module produces functionally equivalent but structurally different versions of critical system applications, thereby maintaining security against advanced threats.
2Object-affected harmful factors
If software applications and processing resources are changed routinely, then malicious software learning and exploitation is thwarted, but system complexity and resource management difficulty increase
Solution Approach 1:
The security module automatically manages the complexity of software version control through self-service mechanisms. It tracks which versions of system applications are currently in use, determines when changes are necessary for security, and coordinates the switching between different versions. This automated self-management reduces the operational burden despite the increased complexity of maintaining multiple software versions.
Solution Approach 2:
The system implements feedback loops where the security module monitors the execution environment, detects potential threats, and triggers appropriate software version changes. The feedback mechanism includes tracking malicious software behavior patterns and adjusting the code generation and version switching strategies accordingly, creating a closed-loop security system that adapts to emerging threats.
3Speed
If new versions of software are generated quickly using software creation tools, then security response time is improved, but processing time and computational resources increase
Solution Approach 1:
The code generation module performs preliminary actions by pre-generating and storing multiple versions of system applications before they are needed for security responses. This advance preparation allows the system to quickly switch to pre-generated versions when threats are detected, avoiding the need for real-time code generation during security incidents. The preliminary generation of software versions reduces the computational burden during critical security responses.
4Object-affected harmful factors
If memory is managed to render learned malicious software ineffective, then attack success rate is reduced, but memory management complexity and performance overhead increase
Solution Approach 1:
The memory management system segments the software execution environment by creating isolated memory spaces for different versions of system applications. When a version change is triggered, the system switches between segmented memory regions containing different software versions. This segmentation approach allows efficient management of multiple software versions in memory without requiring complete reorganization, reducing the complexity overhead while maintaining security effectiveness.
Data Source
AI summary
A computing device includes a central processing resource, memory, a network interface, and a security control module. The security control module determines when to change a program of the computing device. When the program is to be changed, the security control module accesses a library of programs that includes a plurality of versions of the program and selects one of the plurality of versions of the program. The security control module then updates an active program list to include the selected version of the program. When the program is evoked, the central processing resource uses the selected version of the program such that execution of the program is changed, which changes internal operation of the computing device thereby reducing adverse impact of the malicious software.