Non-invasive Program Execution Protection via Control Flow Graph
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software exploits, which hijack the instruction pointer to execute unauthorized code, pose a significant challenge in detecting and preventing security breaches in computing environments, as existing methods lack effective detection mechanisms.
Innovation Solution
A method and system that utilize a control flow graph and symbolic data record generated by simulating the execution of a computer program to detect mismatches in execution flow, allowing for countermeasure actions to be taken when anomalies are detected, using resources external to the program to monitor transition instructions and memory location values.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If invasive modifications are made to detect exploits, then detection capability is improved, but program integrity and performance are degraded
Solution Approach 1:
The patent introduces a control flow graph as an intermediary structure that mediates between the program execution and the detection mechanism. Instead of directly modifying the program or using invasive monitoring, the system creates a simulated control flow graph that represents expected execution paths, then compares actual execution against this model to detect exploits without altering the original program.
Solution Approach 2:
The patent creates a copy of the program's control flow structure (the control flow graph) that can be simulated and compared against actual execution. This copied model allows detection of deviations without modifying the original program, thus maintaining program integrity while enabling exploit detection.
2Measurement precision
If source code access is required for analysis, then detection accuracy is improved, but accessibility and deployment flexibility are reduced
Solution Approach 1:
The patent extracts the essential control flow information from the program without requiring access to source code. By analyzing executable binaries and constructing control flow graphs from runtime behavior, the system extracts detection-capable information while maintaining accessibility and deployment flexibility without source code requirements.
3Loss of time
If real-time monitoring is implemented, then response time to exploits is improved, but system overhead and resource consumption increase
Solution Approach 1:
The patent performs preliminary action by pre-computing and storing the control flow graph model before actual execution occurs. During runtime, the system only needs to compare actual execution paths against the pre-established model, significantly reducing real-time computational overhead while maintaining fast detection response.
Data Source
AI summary
A method for use in a computing device having a processor, the method comprising: executing a computer program on the processor; while the computer program is running, detecting whether any of a plurality of transition instructions of the computer program is executed, the detecting being performed by using resources that are external to the computer program; in response to detecting that a given one of the transition instructions is executed, detecting whether a current execution flow of the computer program matches a control flow graph for the computer program; and performing a countermeasure action based on one of a mismatch of the current execution flow of the computer program and the control flow graph or a current value of a memory location associated with the computer program; wherein the control flow graph for the computer program is generated by simulating an execution of the computer program.