Kernel-Level Security Module for Software Execution Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security systems fail to detect malicious software threats in real time, leading to potential harm before intervention, and generate excessive false positive alerts, disrupting users with unnecessary security interruptions.
Innovation Solution
A two-phased kernel-level security system that validates software programs before execution and monitors them in real time, using pre-execution and execution security modules to identify and respond to suspicious activities, minimizing user interruptions and enhancing detection efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If virtual execution technique is used to detect harmful code, then detection coverage is improved, but measurement precision deteriorates due to high false positive rate
Solution Approach 1:
The system performs preliminary actions by creating a snapshot of the code's initial state before virtual execution begins. This snapshot captures the original code characteristics and is used for later comparison to detect actual harmful changes, thereby reducing false positives while maintaining detection coverage.
Solution Approach 2:
The patent replaces the mechanical virtual execution approach with a code comparison mechanism. Instead of relying solely on virtual execution to detect harmful code, the system substitutes this with a comparison between the initial code snapshot and the modified code, using pattern matching and hashing to identify actual malicious changes.
2Reliability
If conservative virtual execution is implemented to identify suspicious code, then detection coverage is improved, but productivity deteriorates due to high number of security interruptions
Solution Approach 1:
The system replaces conservative virtual execution with a efficient code comparison mechanism using snapshots, hashing, and pattern matching. This substitution dramatically reduces the number of false positive alerts, thereby minimizing security interruptions and improving user workflow efficiency while maintaining detection coverage.
Solution Approach 2:
The patent changes the detection parameter from monitoring all virtual execution activities to comparing specific code characteristics (hashes, patterns, structural elements) between initial and modified states. This parameter change reduces the detection burden and false positives, improving productivity.
3Measurement precision
If real-time code execution monitoring is implemented, then measurement precision is improved, but loss of time increases due to monitoring overhead
Solution Approach 1:
The system performs preliminary action by capturing a snapshot of the code's initial state before execution. This snapshot includes code characteristics, structure, and hashing information that can be quickly compared later to detect harmful changes, eliminating the need for continuous real-time monitoring during execution.
Solution Approach 2:
The patent substitutes continuous real-time monitoring with a before-after comparison mechanism. By comparing the initial code snapshot with the final code state using efficient hashing and pattern matching, the system achieves high detection accuracy without the time overhead of continuous monitoring.
4Reliability
If security devices are added to monitor network activity, then reliability is improved, but device complexity increases
Solution Approach 1:
The patent implements a universal security mechanism that can detect multiple types of harmful code (viruses, malware, trojans, worms) using a single code comparison approach. This multi-functional system eliminates the need for multiple specialized security devices, reducing overall system complexity while maintaining comprehensive security.
Solution Approach 2:
The system changes the security monitoring parameter from multiple device-specific monitoring approaches to a unified code comparison parameter. By using consistent hashing, pattern matching, and snapshot comparison across all code types, the system simplifies the security architecture while improving reliability.
Data Source
AI summary
Managing and controlling the execution of software programs with a computing device to protect the computing device from malicious activities. A protector system implements a two-step process to ensure that software programs do not perform malicious activities which may damage the computing device or other computing resources to which the device is coupled. In the first phase, the protector system determines whether a software program has been previously approved and validates that the software program has not been altered. If the software program is validated during the first phase, this will minimize or eliminate security monitoring operations while the software program is executing during the second phase. If the software program cannot be validated, the protector system enters the second phase and detects and observes executing activities at the kernel level of the operating system so that suspicious actions can be anticipated and addressed before they are able to do harm to the computing device.