Emulator-Based Anomaly Detection for Program Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting anomalous program executions, such as those caused by malicious attacks or software faults, are inadequate in providing real-time detection and mitigation, especially in high-availability systems facing remote attacks or application-level denial of service attacks.
Innovation Solution
The implementation of a system that executes parts of a program in an emulator, compares function calls to a model of normal function calls, and identifies anomalies using probabilistic anomaly detection or one-class support vector machine algorithms, allowing for rapid detection and mitigation of faults or attacks by reversing their effects and generating patches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If antivirus software and firewalls are used to protect against threats, then security against malicious attacks is improved, but real-time detection of anomalous program executions deteriorates
Solution Approach 1:
An emulator is introduced as an intermediary between the program execution and the detection system. The emulator intercepts function calls made by the program and compares them against a model of normal function calls, enabling real-time anomaly detection without requiring direct modification of the program being monitored.
Solution Approach 2:
A model of normal function calls is created as a copy or representation of expected program behavior. This model serves as a reference against which actual function calls are compared, allowing the system to detect deviations from normal behavior patterns without executing the actual program analysis directly.
2Reliability
If traditional antivirus software is deployed, then protection against known threats is improved, but detection of novel attacks and software faults deteriorates
Solution Approach 1:
The system continuously monitors function calls and compares them against the normal behavior model, providing feedback when anomalies are detected. This feedback mechanism enables the system to adapt to novel attacks by identifying deviations from established patterns, even when those attacks have not been previously seen or signed.
Solution Approach 2:
A model of normal function calls is established in advance before actual monitoring begins. This preliminary modeling of expected behavior patterns enables the system to quickly detect anomalies without requiring real-time learning or adaptation, improving response time to novel threats.
3Measurement precision
If comprehensive security monitoring is implemented, then detection accuracy is improved, but system performance and availability deteriorates
Solution Approach 1:
The emulator monitors only function calls rather than all program operations, applying partial monitoring to the most critical aspects of program behavior. This selective approach maintains detection accuracy for security-relevant anomalies while minimizing the performance overhead associated with comprehensive monitoring.
Data Source
AI summary
Methods, media, and systems for detecting anomalous program executions are provided. In some embodiments, methods for detecting anomalous program executions are provided, comprising: executing at least a part of a program in an emulator; comparing a function call made in the emulator to a model of function calls for the at least a part of the program; and identifying the function call as anomalous based on the comparison. In some embodiments, methods for detecting anomalous program executions are provided, comprising: modifying a program to include indicators of program-level function calls being made during execution of the program; comparing at least one of the indicators of program-level function calls made in the emulator to a model of function calls for the at least a part of the program; and identifying a function call corresponding to the at least one of the indicators as anomalous based on the comparison.