Runtime Library Call Chain Hashing for Exploit Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing solutions for detecting vulnerabilities in open source software (OSS) in cloud computing environments suffer from false positives and negatives, and fail to effectively monitor complex applications for zero-day vulnerabilities due to limited visibility and scalability, posing significant cybersecurity risks.

Innovation Solution

A method and system that utilize library call chains to detect exploits in real-time by determining hash values for sequences of software libraries, comparing them against a policy, and triggering mitigation actions upon mismatch, thereby focusing on actively executed libraries to reduce computational burden and improve detection efficiency.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If automated tools like static analysis and dependency scanning are used to identify vulnerabilities in OSS, then vulnerability detection capability is improved, but false positives and false negatives increase

Engineering Contradiction:

Improvevulnerability detection accuracyVSAvoidfalse positive and false negative rate

Core Design Contradiction:

Measurement precisionVSReliability

Solution Approach 1:

The system performs preliminary action by capturing library call chains during a learning phase before production deployment. Hash values of normal library call chains are pre-computed and stored in a data structure during this baseline establishment phase, enabling rapid comparison and detection without false positives in production mode

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system segments the vulnerability detection process into two distinct phases: a learning phase for establishing baseline hash values of normal library call chains, and a production phase for rapid hash-based comparison. This segmentation allows the system to avoid false positives by never comparing against incomplete vulnerability databases during production

Inventive Principle:

Principle #1Segmentation

2Measurement precision

If comprehensive vulnerability scanning of all OSS libraries is performed, then detection coverage is improved, but computational burden and processing time increase

Engineering Contradiction:

Improvevulnerability detection coverageVSAvoiddetection efficiency

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The system extracts only the essential identifying feature of library call chains - their hash values - rather than analyzing complete call chain data. This extraction enables efficient storage in a data structure and rapid comparison operations, achieving both comprehensive coverage and high detection efficiency

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system transforms the library call chain data into a different parameter representation - hash values - which are computationally efficient to compute, store, and compare. This parameter transformation enables the system to handle comprehensive vulnerability scanning without excessive computational burden

Inventive Principle:

Principle #35Parameter changes

3Measurement precision

If real-time monitoring of complex cloud applications is implemented, then exploit detection capability is improved, but system complexity and resource requirements increase

Engineering Contradiction:

Improveexploit detection accuracyVSAvoidmonitoring system complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system creates a simplified copy of the normal library call chain behavior through hash values during the learning phase. This copy serves as a reference model that can be rapidly compared against production behavior without requiring complex analysis of complete call chains, reducing system complexity while maintaining detection accuracy

Inventive Principle:

Principle #26Copying

Solution Approach 2:

The hash value acts as an intermediary representation between the complex library call chain data and the detection logic. This intermediary simplifies the comparison operation and reduces resource requirements while maintaining the ability to detect exploits accurately

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12524534B1Techniques for assessing exploitations in a runtime environment

Publication Date: 2026.01.13 R C RAVEN CLOUD LTD

AI summary

A system and method for efficiently detecting an exploitation during a workload runtime is presented. The method includes fetching a library call chain that has at least a first library, wherein the library call chain is a series of software libraries that are employed in executing the workload at the runtime, wherein the library call chain is fetched based on a trigger of an event at the workload runtime; determining a hash value for the fetched library call chain, wherein the hash value is a numerical representation of the library call chain that has at least the first library; checking the determined hash value against a policy for a match; detecting an exploit in the library call chain upon determining a mismatch between the determined hash value and the policy; and causing an execution of a mitigation action.