Function Call Interception via Bytecode Copying

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing systems for intercepting function calls, events, and messages in software components are time-consuming, resource-intensive, and lack configurability, requiring specialized skills and custom code, making them inefficient for adapting to specific customer needs.

Innovation Solution

A system and method that uses a management platform to receive user rules for processing function calls, developing a high-level script to create a library that captures and filters argument values, and creates API events for execution by a dedicated worker thread, allowing for asynchronous processing and customizable interception.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If custom code is written to intercept function calls, events, and messages, then interception capability is achieved, but development time and resource consumption increase significantly

Engineering Contradiction:
Improveinterception capabilityVSAvoiddevelopment time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The patent uses bytecode copying to create a copy of the original bytecode instructions. This copy is then modified to include interception logic while the original remains intact. The copied bytecode allows the system to intercept function calls without requiring custom code development, thus achieving reliable interception while reducing development time.

Inventive Principle:
Principle #26Copying

Solution Approach 2:

The patent introduces a bytecode interpreter as an intermediary between the compiled bytecode and the execution engine. This interpreter layer enables the system to intercept and analyze bytecode instructions without modifying the original application code, providing interception capability while avoiding the need for custom development work.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Reliability

If existing interception systems are used, then function call monitoring is achieved, but configurability and adaptability to specific customer needs are lost

Engineering Contradiction:
Improvemonitoring capabilityVSAvoidconfigurability
Core Design Contradiction:
ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent implements a dynamic configuration system where interception rules and parameters can be modified at runtime through the management platform. The bytecode interpreter can be dynamically configured to intercept different function calls, events, and messages based on customer-specific requirements, providing both reliable monitoring and high adaptability.

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The patent creates a universal interception framework that can handle multiple types of software components (functions, events, messages) through a single bytecode interpretation mechanism. This multi-functional approach allows the system to adapt to various customer needs without requiring separate custom implementations for each component type.

Inventive Principle:
Principle #6Universality (Multi-functionality)

3Reliability

If synchronous processing is used for function call interception, then real-time monitoring is achieved, but system performance degrades due to processing overhead

Engineering Contradiction:
Improvereal-time monitoringVSAvoidsystem performance
Core Design Contradiction:
ReliabilityVSProductivity

Solution Approach 1:

The patent implements continuous bytecode interpretation where the interpreter processes bytecode instructions in a continuous stream without stopping the application execution. This allows real-time monitoring to be maintained while minimizing performance degradation, as the interpretation happens continuously in the background rather than causing synchronous blocking.

Inventive Principle:
Principle #20Continuity of useful action

Solution Approach 2:

The patent uses periodic sampling and event-driven processing where not every single bytecode instruction is fully processed synchronously. Instead, the system periodically analyzes bytecode streams and processes events asynchronously when relevant, maintaining real-time monitoring capability while reducing the overall processing overhead and improving system performance.

Inventive Principle:
Principle #19Periodic action

Data Source

PatentUS11604674B2Systems and methods for detecting and filtering function calls within processes for malware behavior
Publication Date: 2023.03.14 ELASTICSEARCH BV
  • US11604674B2 patent drawing
  • US11604674B2 patent drawing
  • US11604674B2 patent drawing

AI summary

Systems and methods for monitoring a process a provided. An example method commences with providing a management platform. The management platform is configured to receive user rules for processing at least one function call within the process. A high-level script can be used based on the user rules to develop and install at least one library to execute synchronously within the process. The at least one library can be configured to monitor the process for at least one function call and capture argument values of the function call before the argument values are passed to a function. The at least one library can filter the function call based at least in part on the argument values. The method can continue with selectively creating an API event for execution by a dedicated worker thread. The execution of the API event is performed asynchronously with regard to the process.