Processor Intrusion Detection via Concurrent Checksum Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing antivirus methods struggle to detect polymorphic viruses and other intruders that modify their structure to evade detection, leading to potential system damage and replication before detection, as they rely on pattern matching which is time-consuming and ineffective against constantly changing malware.
Innovation Solution
A processor-based system calculates checksums of program instructions concurrently with execution and compares them to pre-calculated checksums stored in a table, issuing a security exception if a mismatch is found, allowing for real-time detection and prevention of intruder code without the need for pattern matching.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If pattern matching is used to detect viruses, then detection capability is improved, but detection speed deteriorates and polymorphic viruses can evade detection
Solution Approach 1:
The system pre-calculates checksums for all valid program blocks during system initialization or program loading, storing them in a lookup table. During execution, these pre-computed checksums are immediately available for comparison, eliminating the need for time-consuming pattern matching during runtime detection
Solution Approach 2:
The invention replaces the mechanical pattern-matching process with a mathematical checksum verification system. Instead of comparing byte patterns, the system computes and compares checksum values, which are much faster to calculate and compare, especially when pre-computed and stored in lookup tables
2Measurement precision
If pattern matching is used to detect viruses, then detection capability is improved, but polymorphic viruses can modify their structure to evade detection
Solution Approach 1:
The invention extracts the essential property of code integrity (represented by checksums) from the specific byte patterns. By monitoring checksums rather than patterns, the system detects any modification to program blocks regardless of how the intruder code changes its structure or encryption method
Solution Approach 2:
The system changes the detection parameter from specific byte patterns to checksum values. This parameter transformation makes detection robust against polymorphic variations because the checksum reflects the actual functional content of the code rather than its superficial pattern representation
3Reliability
If a posteriori removal of intruder code is performed, then detected viruses are eliminated, but system damage may already be done and replication may have occurred
Solution Approach 1:
The system rushes through the detection process by using pre-computed checksums that can be verified in constant time during program execution. This immediate detection capability allows the system to identify intruders before they can complete harmful actions or replicate, skipping the delayed response inherent in traditional scan-based approaches
Solution Approach 2:
The checksum verification operates continuously during program execution rather than performing discrete scans after the fact. This continuous monitoring ensures that intruder code is detected immediately upon execution, maintaining constant security protection without interruption or delay
4Reliability
If comprehensive antivirus scanning is performed, then detection coverage is improved, but system performance deteriorates
Solution Approach 1:
The system performs the computationally intensive checksum calculation work in advance during system initialization or program loading, storing results in lookup tables. During runtime, only fast checksum comparisons are performed, maintaining both comprehensive detection coverage and high system performance
Solution Approach 2:
The program is divided into basic blocks with individual checksums, allowing selective and efficient verification. This segmentation enables the system to monitor only critical code segments without scanning entire programs, reducing overhead while maintaining comprehensive security coverage
Data Source
AI summary
The present invention provides a method and apparatus for detecting intrusions in a processor-based system. One embodiment of the method includes calculating a first checksum from first bits representative of instructions in a block of a program concurrently with executing the instructions. This embodiment of the method also includes issuing a security exception in response to determining that the first checksum differs from a second checksum calculated prior to execution of the block using second bits representative of instructions in the block when the second checksum is calculated.