Mutable Instruction Set for Malicious Code Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting computerized systems from malicious code require prior knowledge, assumptions about system behavior, and knowledge of vulnerabilities, and are susceptible to evasion techniques, with potential for late detection and exploitation.
Innovation Solution
A system and method that modifies the instruction set of a processor to prevent unauthorized code execution by using a mutating compiler and translator, ensuring only authorized code operates correctly, and raising alerts for unauthorized code, without requiring prior knowledge or assumptions about the code or system behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional protection methods (signature checking, static analysis, vulnerability patching) are used, then protection against known threats is improved, but the system becomes vulnerable to unknown threats and evasion techniques
Solution Approach 1:
The patent applies dynamics by making the instruction set mutable rather than static. The protected processor dynamically changes its instruction set architecture over time, so that authorized code is periodically recompiled with different instruction mnemonics and encodings. This dynamic transformation ensures that protection mechanisms adapt to new threats without requiring prior knowledge of specific attack vectors.
Solution Approach 2:
The patent changes the parameters of the instruction set itself - specifically the mnemonics, encodings, and syntax of machine instructions. By periodically recompiling authorized code with different instruction set parameters, the system creates a moving target that is resistant to static analysis and signature-based detection, while maintaining compatibility with authorized applications.
2Reliability
If the instruction set is made mutable to prevent unauthorized code execution, then protection against malicious code is improved, but the complexity of the system increases due to the need for translators and periodic recompilation
Solution Approach 1:
The patent introduces a translator as an intermediary component between the mutable instruction set and the processor. This translator converts the modified instructions back into standard processor instructions during execution, shielding the processor from complexity while enabling the protected instruction set. The translator acts as a buffer that manages the complexity burden, isolating it from the core processor architecture.
Solution Approach 2:
The system performs preliminary actions by pre-compiling authorized code with the mutable instruction set before execution. This pre-compilation phase handles the complexity of instruction transformation, so that during runtime, the system simply executes the pre-prepared code with minimal overhead. The heavy lifting of instruction set management is done in advance, reducing runtime complexity.
3Measurement precision
If prior knowledge and assumptions about code behavior are required for protection, then detection accuracy is improved, but the ability to detect new and unknown malware is reduced
Solution Approach 1:
The patent inverts the traditional approach by not trying to detect malicious code based on its characteristics, but rather by making it impossible for unauthorized code to execute in the first place. Instead of analyzing code behavior to identify threats, the system proactively prevents execution by using a mutable instruction set that only authorized, pre-compiled code can interpret correctly. This inversion eliminates the need for prior knowledge of malware signatures or behaviors.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
The invention relates to a method for providing a computerized system which is protected from unauthorized programs coming from an external source, the method comprises the steps of (a) secretly, and in a manner unknown to authors of external programs, providing a non-standard compiler which mutates (modifies) each high level program to one or more non-standard mutated machine code instructions that a standard CPU cannot properly execute! (b) subjecting all authorized programs to said non-standard compiler; and (c) providing a translator which converts each mutated machine code instruction resulting from said non-standard compiler to a respective standard instruction which the CPU can properly execute, whereas any program which is not subjected to both said non-standard compiler and said translator will result in one or more instructions that the CPU cannot properly execute.