Interpreter Auxiliary Code for Unknown Object Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus technologies face difficulties in detecting malicious code containing objects for which the emulator or interpreter lacks a rule of interpretation, leading to incomplete execution and potential undetection of malicious functionality.
Innovation Solution
The system employs an auxiliary code that mimics the execution of unknown objects, allowing the interpreter to continue executing program code by halting and resuming execution when encountering unknown objects, using known objects for which rules of interpretation exist, thereby enabling the interpreter to handle objects without altering its program code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the interpreter executes program code containing unknown objects for which it lacks rules of interpretation, then the execution quality improves, but the interpreter must change its program code which requires testing and debugging
Solution Approach 1:
The solution segments the interpretation rules into two parts: core interpreter rules (for known objects) and auxiliary code rules (for unknown objects). The auxiliary code is separated from the main interpreter program code, allowing it to be updated independently without requiring changes to or re-testing of the core interpreter.
Solution Approach 2:
An auxiliary code acts as an intermediary between the interpreter and unknown objects. This auxiliary code contains the interpretation rules for unknown objects, mediating between the interpreter's core functionality and the need to handle new/unknown object types without modifying the interpreter itself.
2Reliability
If the interpreter halts execution when encountering unknown objects, then the interpreter maintains integrity, but the detection of malicious code is incomplete
Solution Approach 1:
The system performs preliminary action by pre-loading auxiliary code that contains interpretation rules for unknown objects before execution begins. This allows the interpreter to handle unknown objects without halting, as the necessary rules are already in place through the auxiliary code mechanism.
Solution Approach 2:
The auxiliary code serves as an intermediary that enables the interpreter to process unknown objects without compromising its integrity. The interpreter interacts with unknown objects through the auxiliary code layer, maintaining its own integrity while achieving complete code detection.
3Adaptability or versatility
If the interpreter updates rules of interpretation for new objects, then the ability to detect new malicious objects improves, but the time required for testing and debugging increases
Solution Approach 1:
By segmenting interpretation rules into core interpreter rules and auxiliary code, updates for new objects can be made in the auxiliary code alone. This segmentation allows rapid adaptation to new malicious objects without requiring time-consuming testing and debugging of the entire interpreter system.
Solution Approach 2:
The auxiliary code is designed to be dynamic and easily updateable. When new object types are encountered, the auxiliary code can be updated to include interpretation rules for these objects without static constraints, enabling rapid adaptation to new threats.
Data Source
AI summary
Disclosed are systems and methods for execution of program code by an interpreter. One exemplary method comprises: generating intermediate instructions based on a unified grammar from instructions of the program code, beginning execution of the intermediate instructions in an emulated computer environment, in response to detecting an instruction of the program code associated with an object for which a rule of interpretation is not found, halting further execution of the intermediate instructions, obtaining an auxiliary code corresponding to the object, wherein a result of execution of the auxiliary code corresponds to the result of the execution of the object, and wherein the auxiliary code contains objects for which the interpreter has a rule of interpretation, executing the instructions of the auxiliary code; and after completion of the execution of the auxiliary code, resuming the execution of the intermediate instructions.