Runtime Environment Malicious Code Detection via Exception State Monitoring
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Runtime environments face challenges in identifying and mitigating malicious code, particularly from unknown or untrusted sources, as existing security measures can be exploited to elevate privileges and bypass exception handling, leading to potential data misappropriation and system vulnerabilities.
Innovation Solution
A method and system that monitor runtime environments for exception trigger conditions and resulting states, identifying malicious code by detecting failures in transitioning to expected exception states, thereby protecting the system from exploitation and allowing for remedial actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security restrictions and controls are imposed on software executing in a runtime environment, then system security is improved, but the ability of malicious code to exploit exception handling mechanisms increases
Solution Approach 1:
The system performs preliminary analysis of the runtime environment code to identify exception trigger conditions and their expected resulting states before execution. This advance preparation creates a baseline of correct exception handling behavior that can be used to detect malicious modifications during runtime.
Solution Approach 2:
The monitoring mechanism continuously observes runtime environment behavior and compares actual exception handling outcomes against expected resulting states. When discrepancies are detected, the system identifies potential malicious code, providing feedback that enables security intervention.
2Measurement precision
If monitoring of runtime environment is implemented to detect exception trigger conditions, then detection of malicious code is improved, but system complexity increases
Solution Approach 1:
The system extracts and isolates specific exception handling mechanisms and trigger conditions from the complex runtime environment for focused monitoring. By concentrating surveillance on critical exception paths rather than all system operations, detection accuracy is maintained while complexity is reduced.
Solution Approach 2:
The monitoring system divides exception handling monitoring into discrete segments based on identified trigger conditions and resulting states. Each segment can be independently analyzed and monitored, making the overall complex task manageable and scalable.
Data Source
Figure 1~2
Figure 3
Figure 4~5
AI summary
A computer implemented method of detecting malicious code in a software application executing with a runtime environment in a computer system, the method comprising: receiving a definition of one or more runtime exception trigger conditions, each trigger condition defining criteria for the runtime environment to enter a software exception state and having associated a definition of a resulting state of the runtime environment having entered the exception state; monitoring the runtime environment to detect the satisfaction of a detected trigger condition by the runtime environment and, in response to a determination that the runtime environment fails to enter a resulting state associated with the detected trigger condition, identifying the software application as including malicious code.