Malware Immunization Tool Integrity Markers Control Flow Hijacking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer systems are vulnerable to malware attacks that compromise program execution integrity, such as control flow hijacking, which existing security measures fail to effectively prevent.
Innovation Solution
A malware immunization tool instruments user-space programs with integrity markers, which are verified by a malware immunization infrastructure before granting access to system resources, using techniques like binary rewriting and system call modifications to ensure program integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing security measures are used to protect against malware, then system security is maintained at current levels, but control flow hijacking and other sophisticated malware attacks cannot be effectively prevented
Solution Approach 1:
The system performs preliminary instrumentation of programs during compilation or loading, embedding integrity markers and verification code before execution. This preliminary action ensures that when malware attempts control flow hijacking, the integrity verification mechanism is already in place to detect and prevent the attack, rather than relying on reactive security measures.
Solution Approach 2:
The patent introduces integrity markers as intermediary elements between the program code and the execution environment. These markers act as mediators that enable the security system to verify program integrity without interfering with normal program execution, allowing detection of control flow hijacking while maintaining system performance.
2Reliability
If program instrumentation with integrity markers is implemented, then malware detection capability is improved, but system complexity and overhead increase
Solution Approach 1:
The system creates simplified copies of verification logic embedded within the instrumented program. Rather than implementing complex external verification mechanisms, the integrity checking code is copied into the program itself during instrumentation, reducing the need for complex external security infrastructure while maintaining detection capability.
Solution Approach 2:
The patent extracts the security verification logic from the main program flow, separating integrity checking operations into distinct, manageable components. This extraction allows the security mechanism to be implemented modularly, reducing overall system complexity while maintaining effective malware detection.
3Reliability
If integrity verification is performed during program execution, then program execution integrity is ensured, but execution time and system performance are reduced
Solution Approach 1:
The integrity verification mechanism skips detailed checking for trusted code paths and only performs verification when necessary, such as when control flow changes are detected or at critical checkpoints. This selective verification approach maintains execution integrity while minimizing performance overhead by avoiding unnecessary verification operations.
Solution Approach 2:
Instead of continuous integrity verification that would significantly impact performance, the system performs periodic checks at strategically chosen points during program execution. This periodic verification approach ensures integrity is maintained while allowing normal execution to proceed at full speed between verification points.
Data Source
AI summary
A computer system may be employed to verify program execution integrity by receiving a request to launch a program that has been instrumented to include at least one integrity marker, instantiating the program with an integrity marker value, and verifying the execution integrity of the program based on the integrity marker value and information received from the program during execution. A computer system may also be employed for program instrumentation by modifying the program to include at least one instruction for passing an integrity marker value to an operating system kernel during execution of the instruction.