Runtime Exception Monitoring for Malicious Code Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Software runtime environments face challenges in identifying and protecting against malicious code, particularly from unknown or untrusted sources, as existing security measures can be exploited to elevate privileges and bypass exception handling, leading to vulnerabilities.

Innovation Solution

A method and system for detecting malicious code by parsing software code to identify exception trigger conditions and resulting states, allowing for extrinsic monitoring and detection of anomalies, thereby protecting the runtime environment from exploitation.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If security restrictions and controls are implemented in the runtime environment to protect against malicious code, then the security of the runtime environment is improved, but malicious code can exploit these restrictions to elevate privileges and bypass security controls

Engineering Contradiction:

Improvesecurity of runtime environmentVSAvoidexploitation of security controls by malicious code

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary analysis of the runtime environment code to identify exception trigger conditions and resulting states before execution. This advance preparation creates a baseline model of legitimate exception handling behavior, enabling the detection system to recognize deviations caused by malicious code attempting to exploit security controls.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent introduces an intermediary detection layer that monitors exception triggering and handling between the malicious code and the runtime environment. This intermediary analyzes exception triggers and resulting states to detect exploitation attempts without directly interfering with the security restrictions themselves.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If exception handling mechanisms are provided in the runtime environment, then software reliability is improved, but malicious code can manipulate exception handling to bypass security and access protected resources

Engineering Contradiction:

Improveexception handling capabilityVSAvoidmanipulation of exception handling by malicious code

Core Design Contradiction:

ReliabilityVSObject-generated harmful factors

Solution Approach 1:

The system implements feedback by monitoring whether actual exception handling behavior matches the expected behavior defined in the preliminary analysis. When malicious code manipulates exception handling to bypass security, the feedback mechanism detects the deviation from the established baseline and triggers appropriate security responses.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

By pre-identifying legitimate exception trigger conditions and resulting states, the system establishes a reference model of proper exception handling. This preliminary characterization enables the system to distinguish between legitimate exception handling and malicious manipulation during runtime execution.

Inventive Principle:

Principle #10Preliminary action

3Adaptability or versatility

If the runtime environment executes software from unknown sources, then system versatility and application portability are improved, but the risk of executing malicious code increases

Engineering Contradiction:

Improveability to execute software from unknown sourcesVSAvoidrisk of malicious code execution

Core Design Contradiction:

Adaptability or versatilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces an intermediary detection system that operates between the runtime environment and the executed software. This intermediary passively monitors exception handling behavior to detect malicious code without interfering with the ability to execute software from unknown sources, thus maintaining versatility while reducing risk.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system performs preliminary analysis to establish a baseline of legitimate exception handling behavior before software execution. This advance preparation enables the detection system to identify malicious code based on deviations from the baseline, allowing the runtime environment to execute unknown software safely.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS10839077B2Detecting malicious software

Publication Date: 2020.11.17 BRITISH TELECOM PLC

AI summary

A computer implemented method of detecting malicious code in a software application executing with a runtime environment in a computer system, the method including: parsing software code corresponding to at least a subset of the runtime environment to identify one or more occurrences of a programmatic dispatch of a software exception; recording, for each identified occurrence, execution state information leading to the exception as a runtime exception trigger condition for the exception; and defining, for each identified occurrence, a resulting state based on the software code for recording in association with the execution state information, wherein the execution state information and associated resulting state definition permit the detection of anomalies in the execution of the runtime environment to detect malicious applications executing with the runtime environment.