Relocatable Code Block Randomization for Attack-Resistant Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software security measures are challenging to monitor and prone to human error, and once an attacker decodes the defense model, it can be exploited for further attacks.
Innovation Solution
Automated deployment of relocatable code blocks with decoy duplicates in memory, combined with a monitoring system to detect potential attacks by randomly placing instrumented code blocks and decoys, ensuring the attacker cannot easily find the real block.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a monitoring system uses fixed defense models, then security coverage is comprehensive, but attackers can decode and exploit the defense model
Solution Approach 1:
The patent implements dynamic defense models where code blocks are randomly relocated to different memory positions during runtime. The monitoring system dynamically generates new defense models by selecting different code blocks as potential targets, making the defense approach adaptive rather than static. This resolves the contradiction by maintaining comprehensive security coverage while preventing attackers from exploiting fixed patterns.
Solution Approach 2:
The system performs preliminary randomization of code block positions before attacker discovery. By pre-establishing random mappings and relocating code blocks in advance, the monitoring system ensures that even if attackers decode the defense model, they cannot exploit it because the actual code positions have already been randomized. This preliminary action neutralizes the potential harm before attacks occur.
2Difficulty of detecting and measuring
If the monitoring system monitors all code blocks, then attack detection capability is high, but system resources are heavily consumed
Solution Approach 1:
The monitoring system segments its attention by using randomization to focus monitoring resources on specific code blocks at specific times. Instead of continuously monitoring all code blocks equally, the system divides monitoring efforts based on randomly selected targets, reducing overall resource consumption while maintaining high detection capability for the selected segments.
Solution Approach 2:
The system implements periodic monitoring where different code blocks are monitored at different time intervals. By periodically changing which code blocks are monitored based on random selection, the system maintains high attack detection capability across all code blocks over time while reducing instantaneous resource consumption compared to continuous monitoring of all blocks.
3Productivity
If defense models are shared across multiple devices, then security efficiency is improved, but a single decoded model can be used to attack multiple devices
Solution Approach 1:
The patent implements dynamic randomization where each device generates and uses different random mappings for code block positions, even when sharing the same defense model. This dynamic differentiation ensures that while security efficiency is improved through model sharing, the actual code positions and monitoring targets differ across devices, preventing a single decoded model from being used to attack multiple devices.
Data Source
AI summary
A computer implemented method is provided. The computer implemented method includes receiving, for execution by a processing element, a relocatable instrumented code block, the relocatable instrumented code block being code that has undergone instrumentation for a monitoring system, duplicating at least one function of the relocatable instrumented code block to produce a plurality of duplicate relocatable code blocks, allocating the instrumented code block and each duplicate relocatable code block of the plurality of duplicate relocatable code blocks to different locations in a memory on a computing device, creating a relocated mapping of the instrumented code block and each duplicate relocatable code block to their corresponding locations in the memory, and transmitting a copy of the mapping of the instrumented code block and each duplicate relocatable code block to their corresponding locations in memory to the monitoring system.