Static Machine Code Validation Using Graphs for Misaligned Instructions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for static analysis of machine code to detect policy violations are challenging due to variable instruction lengths and indirect control flow transitions, making it difficult to identify valid instruction sequences and detect attacks like Return-oriented programming (ROP) and Call-oriented programming (COP).
Innovation Solution
A three-phase approach is employed to generate a control flow graph from misaligned instruction sequences, involving scanning for entry points, constructing a directed control flow graph, and applying customizable security policies to validate machine code statically without execution, using a processor's instruction set architecture (ISA).
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static analysis is used to validate machine code for security properties, then security validation capability is improved, but analysis accuracy deteriorates due to variable instruction lengths and indirect control flow transitions
Solution Approach 1:
The patent segments the machine code into fixed-size instruction windows (e.g., 15 bytes) and processes each window independently to identify potential instruction sequences. This segmentation approach transforms the complex variable-length instruction parsing problem into manageable fixed-size analysis units, enabling systematic static validation while maintaining accuracy in detecting valid instruction boundaries and control flow transitions.
2Measurement precision
If dynamic binary translation is used to establish security boundaries, then validation accuracy is improved, but execution speed deteriorates
Solution Approach 1:
The patent performs preliminary static analysis of machine code during the loading or compilation phase, generating control flow graphs and validating security properties before actual execution. This preliminary validation identifies potential security violations upfront, allowing the system to reject malicious code without incurring runtime overhead, thus maintaining both high accuracy and execution speed.
Solution Approach 2:
The patent replaces the mechanical runtime interpretation approach of dynamic binary translation with a static analysis mechanism that uses pattern matching and control flow graph construction. This substitution eliminates the need for slow runtime code translation while maintaining validation accuracy through systematic analysis of instruction sequences and control flow patterns.
3Reliability
If comprehensive static analysis is performed on all code, then security coverage is improved, but computational complexity deteriorates
Solution Approach 1:
The patent applies local quality analysis by focusing computational resources on critical security-relevant regions of the code, such as control flow transitions, function entry/exit points, and indirect jump targets. Rather than uniformly analyzing every instruction, the system identifies and intensively analyzes only those regions most susceptible to security violations like ROP and COP attacks, reducing overall computational complexity while maintaining comprehensive security coverage.
Solution Approach 2:
The patent implements partial analysis by applying static validation selectively to code regions that require security verification, such as untrusted code segments or dynamically loaded libraries, rather than uniformly analyzing the entire codebase. This partial action approach concentrates computational effort where it is most needed, achieving effective security coverage without the prohibitive complexity of analyzing all code comprehensively.
Data Source
AI summary
Novel graph analytics herein detect security violations in machine code. Here is static validation of machine code for detecting policy violations in an accelerated way that analytically generates a control flow graph from misaligned sequences of instructions that may, for example, partially overlap (i.e. share some of the bytes) in a memory buffer. In a first analytic phase, entry points into machine code are discovered. The entry points are starting points of control flow analysis that generates a directed control flow graph (CFG) in a second analytic phase. In a third analytic phase, interchangeable and combinable security policies implement the graph analytics in a flexible way that can be customized for a processor and its instruction set architecture (ISA). This approach will quantifiably increase the reliability of a computer that executes untrusted code such as an open source library or tenant logic in a multitenant environment such as a public cloud.