Operating System Modification for Malicious Code Prevention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting computerized systems from malicious code require prior knowledge of the code, its behavior, or vulnerabilities, and are susceptible to evasion techniques, late detection, and exploitation through unknown vulnerabilities, especially in open-source and isolated operating systems.
Innovation Solution
Modifying essential elements of the operating system and benign programs to require compliance with specific modifications for execution, thereby preventing unauthorized code from running and detecting malicious activity early, even if it operates solely in memory without passing through the file system.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional protection methods (signature checking, static analysis, vulnerability patching) are used, then known malicious code can be detected and blocked, but unknown malware and new exploits cannot be identified, and detection occurs too late after significant damage
Solution Approach 1:
Instead of allowing code to run and then checking for malicious behavior, the patent inverts the approach by modifying essential system elements first, which causes all unauthorized code to fail before execution. Only code that is预先 modified to comply with the changed system elements can run, effectively detecting malicious code before it can cause damage.
Solution Approach 2:
The patent performs preliminary modification of essential system elements (system calls, libraries, instruction sets) before any code execution. This preliminary action establishes a protective barrier that prevents unauthorized code from running, and benign code is预先 modified to comply with these changes, enabling detection before actual malicious behavior occurs.
2Measurement precision
If prior knowledge of code behavior and vulnerabilities is required for protection, then detection can be performed using known signatures, but the system cannot protect against zero-day exploits and unknown malware
Solution Approach 1:
The system performs preliminary modification of essential system elements before any code execution or before knowledge of specific threats is available. This creates a universal protective mechanism that works against both known and unknown malware without requiring prior intelligence about specific threats or their behaviors.
Solution Approach 2:
The patent creates a universal protection mechanism by modifying fundamental system elements that all code must interact with. This single approach provides multi-functional protection against various types of threats including viruses, worms, ransomware, and zero-day exploits, eliminating the need for threat-specific detection methods.
3Reliability
If code is allowed to run without modification, then system compatibility is maintained, but malicious code can operate undetected; if code is modified for security, then detection capability improves, but compatibility with unmodified code is lost
Solution Approach 1:
Instead of modifying code to fit the system, the patent modifies the system elements that code interacts with. This inversion allows the system to maintain compatibility requirements while enabling security detection, as the modification burden is placed on the system rather than on each individual piece of code.
Solution Approach 2:
The patent introduces modified system elements (system calls, libraries, instruction sets) as intermediaries between the hardware and the executing code. These intermediaries provide the security checking functionality while maintaining the appearance of standard system interfaces, thus preserving compatibility for properly modified benign code while blocking malicious code.
Data Source
Figure 1
Figure 2
Figure 3a
AI summary
The invention relates to a method for providing a computerized system which is protected from malicious programs coming from an external source, the method comprises the steps of (a) secretly, and in a manner unknown to authors of external programs, modifying one or more essential elements at the protected system in a manner which causes all running programs to fail, unless they are subjected to a compatible modification which enables them to run properly; and (b) modifying each program at the computerized system which is known to be benign in order to comply with said modification of one or more essential elements, thereby to enable it to be executed properly.