Interface Invocation Verification via Call Format Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing interface monitoring techniques are ineffective in detecting malicious code that hides its identity by obfuscating return addresses, making it difficult to validate the legitimacy of interface invocations.
Innovation Solution
A verification system that selects and analyzes multiple call instruction formats and return target addresses to determine if control return would invoke legitimate interfaces, intercepting and validating interface invocations by matching candidate target addresses with interface addresses, and using templates to examine code contexts and JMP instructions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional return address examination is used to verify interface invocation legitimacy, then security monitoring capability is improved, but detection effectiveness deteriorates due to obfuscation techniques
Solution Approach 1:
The patent transitions from examining only return addresses (one dimension) to analyzing multiple call instruction formats and their associated parameters (multiple dimensions). By checking candidate target addresses against interface addresses across different call formats, the system overcomes obfuscation that hides return addresses in traditional monitoring approaches.
2Measurement precision
If multiple call instruction formats are analyzed to improve detection accuracy, then detection precision is improved, but system complexity increases
Solution Approach 1:
The patent segments the analysis into distinct call instruction formats (e.g., BL, BLX, B) with specific templates for each. Each format is analyzed independently using its own template, which breaks down the complex task of multi-format analysis into manageable, standardized segments that can be processed systematically.
Solution Approach 2:
The system changes parameters such as candidate target address, call instruction format type, and template structure based on the specific format being analyzed. By dynamically adjusting these parameters according to the detected call format, the system maintains high detection precision while managing complexity through parameterized analysis rather than hard-coded logic for each format.
3Reliability
If return target address verification is performed to prevent malicious invocations, then security reliability is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary analysis by establishing templates for different call instruction formats and pre-identifying interface addresses before actual invocation verification. This preliminary preparation allows the verification process to proceed more efficiently by comparing against pre-established patterns rather than performing full analysis during each verification event.
Data Source
AI summary
A verification system, method and computer program product are provided. In one embodiment, one of a plurality of call instruction formats is selected. In addition, it is verified whether an invocation of an interface was attempted by code utilizing the selected call instruction format. Further, the selection and the verification are repeated for each of the plurality of call instruction formats. In another embodiment, a return target address is identified. Still yet, it is determined whether return of contra to the return target address would result in invocation a one of a plurality of interfaces.