Runtime Memory Corruption Remediation via Dynamic Instrumentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Network accessible applications are vulnerable to memory corruption attacks, allowing malicious attackers to execute arbitrary code and extract sensitive information, with existing solutions failing to effectively protect against sophisticated runtime memory corruption attacks.
Innovation Solution
The implementation of instrumentation engines and analysis engines that extract a model of a computer application as it loads into memory, insert instructions to collect data at runtime, and analyze this data against a stored model to detect security events, modifying computer routines and memory structures to prevent malicious attacks through hot patching and dynamic software updating.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security measures are used, then implementation simplicity is maintained, but security against memory corruption attacks is insufficient
Solution Approach 1:
The system performs preliminary actions by extracting a model of the computer application during load time, before the application fully executes. This includes identifying memory regions, control flow paths, and data structures in advance, so that when runtime attacks occur, the system can quickly compare actual behavior against the pre-established model to detect anomalies without requiring complex real-time analysis mechanisms.
Solution Approach 2:
The patent introduces an intermediary security system that sits between the application and the underlying operating system. This intermediary layer instruments the application code to collect runtime data, compares it against the extracted model, and intervenes when security violations are detected. This mediator approach provides comprehensive security without requiring fundamental changes to the application or OS, resolving the contradiction between security enhancement and system complexity.
2Measurement precision
If runtime monitoring and analysis are implemented, then detection precision improves, but processing overhead increases
Solution Approach 1:
The system applies local quality by focusing monitoring efforts on specific critical regions and operations within the application rather than uniformly monitoring all code. The extracted model identifies important memory regions (stack, heap, code segments), critical control flow paths, and sensitive data structures. The instrumentation engine selectively instruments only these critical areas, enabling precise detection of security events while minimizing processing overhead by avoiding unnecessary monitoring of non-critical code paths.
Solution Approach 2:
The patent implements partial action by performing comprehensive model extraction at load time, creating a detailed reference model of the application's memory layout and control flow. This preliminary comprehensive action enables the runtime system to use simpler, faster comparison-based detection rather than requiring equally comprehensive real-time analysis. The heavy lifting is done once during loading, allowing lightweight monitoring during execution.
3Reliability
If patches are applied to fix vulnerabilities, then security reliability improves, but application execution may be interrupted
Solution Approach 1:
The system applies preliminary anti-action by detecting and neutralizing security threats before they can cause harm or require patching. The runtime monitoring continuously compares actual application behavior against the extracted model, detecting memory corruption attempts, unauthorized control flow changes, and other security violations in advance. When anomalies are detected, the system can take corrective actions (such as terminating malicious code execution or restoring legitimate state) before the application needs to be patched or restarted, thus maintaining continuous operation while providing security protection.
Data Source
AI summary
In example embodiments, systems and methods extract a model of a computer application during load time and store the model in memory. Embodiments may insert instructions into the computer application at run time to collect runtime state of the application, and analyze the collected data against the stored model to perform detection of security events. Embodiments may also instrument an exception handler to detect the security events based on unhandled memory access violations. Embodiments may, based upon the detection of the security events, dynamically respond, such as by modify a computer routine associated with an active process of the computer application. Modification may include installing or verifying an individual patch in memory associated with the computer application.