Runtime Binary Slimming via Execution Trace Scoring

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for reducing the binary attack surface area during program execution face challenges in determining the optimal time for binary rewriting, leading to potential overhead or missed opportunities for code reduction, as they require access to source code and can cause delays or leave applications vulnerable.

Innovation Solution

A heuristic-based algorithm that scores basic blocks in execution traces to identify the best location for initiating runtime binary slimming, maximizing code removal while minimizing disruption to the application's execution, without requiring access to source code or manual effort.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Object-affected harmful factors

If runtime binary slimming is performed early in application execution, then the binary attack surface area is reduced more effectively, but the application execution is disrupted and overhead increases

Engineering Contradiction:

Improvebinary attack surface areaVSAvoidapplication execution delay

Core Design Contradiction:

Object-affected harmful factorsVSLoss of time

Solution Approach 1:

The system performs preliminary analysis of execution traces to identify optimal slimming locations before actually performing binary rewriting. By pre-analyzing the execution patterns and scoring potential rewrite locations, the system prepares in advance to minimize disruption when the actual rewriting occurs, thus reducing execution delay while maintaining security effectiveness.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system dynamically determines the optimal location for binary slimming based on actual execution traces rather than using a fixed or static approach. The heuristic algorithm scores different basic blocks based on runtime behavior, allowing the system to adapt to the actual execution patterns and choose the most appropriate moment for rewriting, thereby balancing security reduction with minimal execution disruption.

Inventive Principle:

Principle #15Dynamics

2Productivity

If runtime binary slimming is performed late in application execution, then application execution is minimized, but the binary attack surface area remains exposed longer

Engineering Contradiction:

Improveapplication execution efficiencyVSAvoidbinary attack surface area

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system uses execution traces as feedback to determine when to perform binary slimming. By monitoring actual execution patterns and using this feedback to score potential rewrite locations, the system identifies the optimal moment that balances security needs with execution efficiency, preventing both premature and delayed slimming.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent replaces manual or static determination of slimming timing with an automated heuristic algorithm that analyzes execution traces. This substitution of mechanical/manual processes with an intelligent system enables dynamic optimization of the slimming timing, achieving both security reduction and execution efficiency simultaneously.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Adaptability or versatility

If binary slimming is performed without source code access, then existing applications can be protected without modification, but determining the optimal slimming location becomes more difficult

Engineering Contradiction:

Improveapplicability to existing applicationsVSAvoidoptimal slimming location identification

Core Design Contradiction:

Adaptability or versatilityVSDifficulty of detecting and measuring

Solution Approach 1:

The system enables existing applications to protect themselves by instrumenting them to collect their own execution traces. The applications self-generate the data needed to identify optimal slimming locations through their own runtime behavior, eliminating the need for external source code access or manual analysis while maintaining adaptability to any application.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent introduces execution traces as an intermediary between the application and the binary slimming process. Instead of directly accessing source code, the system uses traces as a mediator to infer execution patterns and determine optimal rewrite locations, enabling source-code-free analysis while accurately identifying slimming opportunities.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11650801B2Determining when to perform and performing runtime binary slimming

Publication Date: 2023.05.16 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Multiple execution traces of an application are accessed. The multiple execution traces have been collected at a basic block level. Basic blocks in the multiple execution traces are scored. Scores for the basic blocks represent benefits of performing binary slimming at the corresponding basic blocks. Runtime binary slimming is performed of the application based on the scores of the basic blocks.