Parallel Program Variant Execution for Malicious Code Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Computer systems, particularly those for e-commerce and e-government, face vulnerabilities such as buffer overflows that can allow remote attackers to execute malicious code, compromising the trustworthiness of software platforms by exploiting lack of bounds checks, leading to unintended execution of attacker-provided code.
Innovation Solution
Generating semantically equivalent program variants with altered characteristics like stack growth direction, register allocation, and heap allocation, and executing these variants in lockstep to detect functional differences, thereby preventing abnormal behavior and potential attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple program variants are generated and executed in parallel to detect malicious code injection, then security reliability is improved, but system complexity and execution overhead increase
Solution Approach 1:
The system segments the original program into multiple semantically equivalent variants by modifying non-functional characteristics such as register allocation, stack growth direction, and heap allocation patterns. Each variant executes independently but produces identical functional results for legitimate code, while diverging on malicious code execution. This segmentation allows parallel detection without requiring complete system redesign.
Solution Approach 2:
The system creates multiple copies of the program with altered non-functional properties rather than modifying the functional logic. These copies execute in parallel and are monitored for behavioral differences. The copying approach enables security verification through comparison while maintaining the original program's functionality, as all variants should produce identical results for legitimate operations.
2Measurement precision
If program variants are executed in lockstep with monitoring for functional differences, then detection precision is improved, but execution speed decreases
Solution Approach 1:
The system performs preliminary actions by generating all program variants before execution and establishing the monitoring framework in advance. The variants are prepared with different non-functional characteristics but identical functional behavior, allowing the monitoring system to be pre-configured to detect specific types of divergences. This preliminary setup enables efficient real-time detection during execution without adding significant overhead.
Solution Approach 2:
The system implements continuous feedback monitoring by comparing the execution states of multiple variants in real-time. When a functional difference is detected between variants, the system immediately identifies this as potential malicious code execution. The feedback mechanism allows precise detection while minimizing performance impact by only intervening when actual differences are observed, rather than continuously analyzing all execution parameters.
Data Source
AI summary
Techniques, computer program products, apparatus and systems for controlling operation of a program code in a digital processor, a computer or a computer system, including techniques for generating program variants, monitoring execution of a program and variants of the program, and detecting functional differences between the multiple executions.