Resilient Multi-Variant Execution Verification for Cyber Resiliency

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing Multi-Variant Execution Environments (MVEE) lack effective mechanisms for maintaining cyber resiliency, particularly in ensuring availability and rapid recovery after detecting malicious input, as they struggle with identifying compromised variants and restoring services without significant downtime or data loss.

Innovation Solution

Resilient Multi-Variant Execution Verification (RMVEV) integrates control flow integrity, time-delayed execution, checkpoint/restore mechanisms, and malicious input identification to ensure high availability, adapt to malicious inputs, and isolate threats, using orthogonal comparison criteria and internal execution state analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If multiple application variants are executed simultaneously to detect cyberattacks, then detection capability is improved, but system complexity increases

Engineering Contradiction:

Improveattack detection capabilityVSAvoidsystem complexity

Core Design Contradiction:

Measurement precisionVSDevice complexity

Solution Approach 1:

The system segments the application into multiple variants that execute in parallel. Each variant processes the same input data but may respond differently to malicious inputs, enabling diversified detection without requiring a monolithic complex detection system

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Multiple copies of the application are created with slight modifications (variants). These copies run simultaneously and compare outputs to detect anomalies. The copying approach allows detection through comparison while managing complexity through standardized variant generation

Inventive Principle:

Principle #26Copying

2Measurement precision

If variant output comparison is performed to detect attacks, then detection accuracy is improved, but false positives from benign divergence increase

Engineering Contradiction:

Improvedetection accuracyVSAvoidfalse positive rate

Core Design Contradiction:

Measurement precisionVSReliability

Solution Approach 1:

The comparison mechanism applies different scrutiny levels to different parts of the output. Critical outputs undergo strict verification while non-critical variations are tolerated, reducing false positives from benign divergences while maintaining detection accuracy for actual attacks

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system dynamically adjusts comparison parameters such as tolerance thresholds and verification depth based on the type of operation and risk assessment. This allows the system to be more lenient for benign variations and stricter for potential attacks, balancing accuracy and false positive rates

Inventive Principle:

Principle #35Parameter changes

3Reliability

If service restoration is performed after attack detection, then availability is improved, but downtime and data loss occur during restoration

Engineering Contradiction:

Improveservice availabilityVSAvoidrestoration downtime

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system prepares backup variants and restoration mechanisms in advance before attacks occur. When an attack is detected, pre-prepared clean variants can immediately take over, minimizing restoration downtime and preventing data loss through pre-configured failover capabilities

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system maintains redundant variants in a ready state that can cushion against service disruption. These standby variants act as a buffer, allowing immediate switchover when attacks are detected, thereby reducing both downtime and potential data loss during restoration

Inventive Principle:

Principle #11Beforehand cushioning (Prior cushioning)

4Measurement precision

If fine-grained control flow comparison is implemented, then attack detection precision is improved, but processing overhead increases

Engineering Contradiction:

Improveattack detection precisionVSAvoidprocessing overhead

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The system performs fine-grained control flow comparison selectively rather than universally. It applies intensive comparison only to critical code paths and branches where attacks are most likely to manifest, while using lighter verification for less critical sections, thus balancing detection precision with processing overhead

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11520877B2Resilient multi-variant execution verification

Publication Date: 2022.12.06 RAYTHEON CO

AI summary

Generally discussed herein are systems, apparatuses, and methods for cyber resiliency. An apparatus can include one or more memory devices including a plurality of instruction sets corresponding to respective application variants stored thereon, one of the application variants including an unmodified version of an application, and one of the application variants including a modified version of the application including the application altered to be resistant to a specified type of cyberattack, processing circuitry to execute the application variants based on a same input, and generate an output, and a monitor to compare output from each of the application variants, and in response to detecting that the output from an application variant of the application variants is not equal to the output from other application variants of the application variants executing a time delayed version of the application variants or restoring the application variants to a known good operating state.