Executable Content Conformance Checking for Instant Messaging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Instant messenger applications face significant risks from malicious executable content that can cause undesirable actions, such as virus propagation and system disruption, due to their dynamic nature and rapid user interaction, which existing virus-checking mechanisms are not well-suited to handle effectively.
Innovation Solution
Implementing a conformance-checking functionality that uses an 'allow list' paradigm to assess executable content against predetermined permissible patterns of behavior, rather than relying on a knowledge base of known malicious content, to determine if the content is safe for execution, thereby preventing potentially unsafe actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional virus-checking mechanisms are used to detect malicious content, then the system can identify known viruses, but it cannot effectively handle new or unknown malicious content and is not well-suited for the rapid propagation environment of instant messengers
Solution Approach 1:
Instead of checking if content matches known virus patterns (blacklist approach), the patent inverts the approach by checking if content conforms to predetermined safe patterns (whitelist approach). The conformance checker verifies that executable content adheres to expected behavioral patterns rather than attempting to identify all possible malicious patterns, thereby effectively handling new and unknown threats.
2Ease of operation
If executable content is automatically executed in IM applications to provide dynamic features, then user engagement is improved, but the risk of rapid virus propagation increases
Solution Approach 1:
The patent implements preliminary conformance checking of executable content before it is automatically executed in the IM application. The conformance checker validates content against predetermined patterns of safe behavior in advance, allowing the system to automatically execute content while maintaining security by blocking potentially malicious content before it can propagate.
3Reliability
If an allow list paradigm is used to check content conformance, then the system becomes more restrictive and safer, but the complexity of implementing and maintaining the pattern knowledge base increases
Solution Approach 1:
The patent changes the parameter of content validation from pattern matching against known viruses to conformance checking against predetermined safe patterns. This parameter change transforms the validation approach into a more systematic and maintainable process where patterns represent expected safe behavior rather than attempting to enumerate all possible threats.
Data Source
AI summary
Security provisions are described which determine whether or not executable content is likely to perform undesirable actions. The security provisions assess that an executable content item poses an acceptable risk when it conforms to an allow list of predetermined patterns of permissible behavior. The security provisions find exemplary use in the context of an instant messaging environment, where participants can consume and propagate executable content in the course of conducting a communication session. Supplemental rules are described which prevent malicious code from subverting the allow list design paradigm.