Runtime Environment Malicious Code Detection via Exception Monitoring

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Runtime environments face challenges in identifying and mitigating malicious code, particularly from unknown or untrusted sources, as existing security measures can be exploited to elevate privileges and bypass exception handling, leading to vulnerabilities.

Innovation Solution

A method and system for detecting malicious code by defining runtime exception trigger conditions and monitoring the runtime environment to identify deviations from expected states, allowing for the identification and remediation of malicious software, even when it attempts to exploit exception handling processes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If security restrictions and controls are implemented in the runtime environment to protect against malicious code, then system security is improved, but the complexity of the runtime environment increases and may be exploited by malicious code to elevate privileges

Engineering Contradiction:

Improvesystem securityVSAvoidruntime environment complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent segments the security monitoring function into a separate external monitoring component that observes runtime exception conditions independently from the runtime environment itself. This external monitor tracks exception trigger conditions and resulting states without being part of the runtime environment's internal security mechanism, thereby reducing the complexity burden on the runtime environment while maintaining security through divided monitoring responsibilities

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an external monitor as an intermediary component that stands between the runtime environment and the security analysis function. This intermediary observes exception conditions and states without directly interacting with or modifying the runtime environment's security controls, allowing security monitoring without increasing the runtime environment's internal complexity

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If the runtime environment monitors and enforces exception handling strictly to detect malicious code, then detection accuracy is improved, but malicious code can manipulate exception handling processes to bypass detection

Engineering Contradiction:

Improvemalicious code detection accuracyVSAvoidexploitation of exception handling

Core Design Contradiction:

Measurement precisionVSObject-affected harmful factors

Solution Approach 1:

Instead of having the runtime environment internally monitor its own exception handling (which can be manipulated), the patent inverts the approach by using an external monitor to observe the runtime environment's exception behavior from the outside. This external perspective cannot be manipulated by code running within the runtime environment, thereby preventing exploitation while maintaining detection accuracy

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The external monitor acts as an unmanipulable intermediary that observes exception trigger conditions and resulting states without being subject to manipulation by malicious code. This intermediary position ensures that the monitoring process itself cannot be exploited, while still achieving precise detection of malicious behavior through careful analysis of exception patterns

Inventive Principle:

Principle #24Intermediary (Mediator)

3Difficulty of detecting and measuring

If the runtime environment parses and analyzes its own exception handling code to identify malicious behavior, then detection capability is improved, but the analysis process becomes vulnerable to manipulation by malicious code

Engineering Contradiction:

Improvemalicious code identification capabilityVSAvoiddetection system trustworthiness

Core Design Contradiction:

Difficulty of detecting and measuringVSReliability

Solution Approach 1:

The patent extracts the code parsing and analysis function from the runtime environment itself and places it in an external monitoring component. This external parser analyzes the runtime environment's exception handling code without being subject to manipulation by malicious code running within that environment, thereby maintaining both detection capability and system trustworthiness

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Instead of the runtime environment analyzing its own code (creating a trust vulnerability), the patent inverts the analysis relationship by having an external component parse and analyze the runtime environment's exception handling behavior. This external analysis cannot be manipulated by code executing within the monitored environment, preserving detection reliability

Inventive Principle:

Principle #13The other way round (Inversion)

Data Source

PatentUS10733296B2Software security

Publication Date: 2020.08.04 BRITISH TELECOM PLC

AI summary

A computer implemented method of detecting malicious code in a software application executing with a runtime environment in a computer system, the method including: receiving a definition of one or more runtime exception trigger conditions, each trigger condition defining criteria for the runtime environment to enter a software exception state and having associated a definition of a resulting state of the runtime environment having entered the exception state; monitoring the runtime environment to detect the satisfaction of a detected trigger condition by the runtime environment and, in response to a determination that the runtime environment fails to enter a resulting state associated with the detected trigger condition, identifying the software application as including malicious code.