Interpreter Handling Unknown Objects via Auxiliary Code
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus technologies face challenges in detecting malicious code containing objects for which the emulator and interpreter lack a rule of interpretation, leading to incomplete execution and detection failures.
Innovation Solution
The method involves executing program code by an interpreter in an emulated environment, halting execution when encountering unknown objects, obtaining auxiliary code with known objects, executing the auxiliary code, and resuming the original code execution, thereby enabling continued execution without altering the interpreter's rules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the interpreter executes program code containing unknown objects for which it lacks interpretation rules, then the execution quality deteriorates and detection fails, but if the interpreter halts execution upon encountering unknown objects, then productivity decreases
Solution Approach 1:
The patent introduces auxiliary code as an intermediary element that bridges the gap between the interpreter and unknown objects. When the interpreter encounters an unknown object, it retrieves auxiliary code that provides interpretation rules for that object, allowing execution to continue without halting. This mediator (auxiliary code) enables the system to maintain both high execution quality and productivity by preventing execution failures while minimizing interruptions.
2Adaptability or versatility
If the interpreter is updated to add interpretation rules for new objects, then adaptability improves, but device complexity increases and maintenance burden grows
Solution Approach 1:
The patent segments the interpretation rules into two distinct components: core interpreter rules (for common objects) and auxiliary code rules (for unknown or rare objects). This segmentation allows the core interpreter to remain simple and stable while adaptability is achieved through external auxiliary code that can be added or updated without modifying the core interpreter. The auxiliary code acts as a separate, modular layer that enhances versatility without increasing core system complexity.
Solution Approach 2:
The patent extracts the interpretation rules for unknown objects from the core interpreter and places them in separate auxiliary code modules. This extraction allows the core interpreter to maintain its simplicity while still being able to handle a wide variety of objects by retrieving appropriate auxiliary code when needed. The interpretation rules are taken out of the main system and stored externally, reducing device complexity while improving adaptability.
3Measurement precision
If the interpreter halts execution when encountering unknown objects, then measurement precision of malicious code detection improves, but loss of time increases
Solution Approach 1:
The patent implements preliminary action by pre-retrieving auxiliary code before execution interruptions occur. When the interpreter encounters an unknown object, it immediately fetches the corresponding auxiliary code from storage, rather than halting for extended periods. This preliminary retrieval action minimizes execution interruption time while maintaining detection precision, as the interpreter is ready to continue execution almost immediately after encountering the unknown object.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclose are systems and methods for execution of program code by an interpreter. One exemplary method comprises: executing, by the interpreter, instructions of the program code in an emulated computer environment; when detecting, by the interpreter, an instruction of the program code associated with an unknown object for which the interpreter lacks a rule of interpretation, halting by the interpreter further execution of the instructions of the program code; obtaining, by the interpreter, an auxiliary code whose result of execution corresponds to the result of the execution of the unknown object, wherein the auxiliary code contains known objects for which the interpreter has a rule of interpretation; executing, by the interpreter, the instructions of the auxiliary code; and after completion of the execution of the auxiliary code, by the interpreter, resuming the execution of the instructions of the program code.