Interpreter API Patching to Thwart Unknown Malicious Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Signature-based intrusion detection systems are ineffective against unknown attacks, and existing mitigation techniques like ASLR and DEP merely raise the bar for exploiting vulnerabilities in web browsers, which are common targets of attack vectors that inject malicious code through predictable API invocations.
Innovation Solution
Implement an interpreter-based cybersecurity agent (IBCA) that patches and intercepts native APIs in interpreter-based applications, creating a chaotic execution environment by manipulating API invocations to be unpredictable, thereby thwarting malicious code execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based intrusion detection systems are used to detect security breaches, then detection accuracy for known threats is improved, but effectiveness against unknown attacks deteriorates
Solution Approach 1:
The system performs preliminary patching of exposed APIs before malicious code execution, establishing a protective layer in advance. The cybersecurity agent intercepts and patches API invocations proactively, transforming predictable API behaviors into unpredictable ones before attacks can exploit them, thus preventing both known and unknown threats
2Reliability
If mitigation techniques like ASLR and DEP are implemented, then security against exploits is improved, but ease of operation deteriorates
Solution Approach 1:
The interpreter-based cybersecurity agent serves as an intermediary between the interpreter-based application and the operating system APIs. It transparently intercepts and patches API invocations, providing security protection without requiring changes to the application code or user operations, thus maintaining ease of operation while improving reliability
3Object-affected harmful factors
If exposed APIs are patched to exhibit non-native functionality, then malicious code exploitation is prevented, but legitimate code functionality may be affected
Solution Approach 1:
The system applies different patching strategies to different execution contexts. The cybersecurity agent identifies and patches only the specific API invocations that are vulnerable to exploitation while maintaining the original functionality for legitimate code paths. This localized approach ensures that malicious code exploitation is prevented without affecting legitimate code functionality
4Reliability
If an interpreter-based cybersecurity agent is injected to intercept API invocations, then security against malicious code is improved, but device complexity increases
Solution Approach 1:
The interpreter-based cybersecurity agent is designed to self-manage its operation within the interpreter-based application. It automatically detects exposed APIs, patches them dynamically, and adapts to different execution contexts without requiring external configuration or management infrastructure, thus improving security while minimizing the increase in device complexity
Data Source
AI summary
A non-transitory computer readable medium contains instructions that when executed cause one or more processors to perform cybersecurity operations that include detecting an interpreter-based application configured to exhibit native functionality and to generate a plurality of execution contexts following receipt of an original input code. An interpreter-based cybersecurity agent is injected within the detected interpreter-based application, which is itself configured for execution by the interpreter-based application prior to execution of the original input code. Exposed APIs are patched using the injected interpreter-based cybersecurity agent to cause patched APIs to exhibit non-native functionality in order to thwart exploitations.