Runtime Monitoring Precision Tuning via Static Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current runtime monitoring techniques for web-enabled software are resource-intensive and often ineffective, leading to either false negatives or false positives, as they lack precision and can be expensive, draining system performance and resources.
Innovation Solution
A method and system that perform preliminary program analysis to determine security vulnerabilities, allowing for precision-tuned runtime monitoring by configuring high precision for vulnerable portions and low precision for less vulnerable ones, using an oracle to store and apply the results of shape analysis and other analyses to optimize monitoring.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If runtime monitoring is applied with high precision to all portions of executable, then security detection accuracy is improved, but system resource consumption increases significantly
Solution Approach 1:
The patent applies different monitoring precision levels to different portions of the executable based on their security vulnerability characteristics. High precision monitoring is applied only to vulnerable portions identified through static analysis, while low precision monitoring is applied to non-vulnerable portions. This resolves the contradiction by making monitoring precision local rather than uniform, thereby maintaining security detection accuracy where needed while reducing overall system resource consumption.
2Productivity
If runtime monitoring is applied with low precision to reduce resource usage, then system performance is improved, but false negatives and false positives increase
Solution Approach 1:
The patent performs static analysis (shape analysis, taint analysis, data flow analysis) before runtime monitoring to pre-identify vulnerable portions of the executable. This preliminary action creates a vulnerability profile that guides runtime monitoring precision allocation. By preparing this vulnerability information in advance, the system can apply high precision monitoring only where needed, thereby maintaining security monitoring reliability while improving overall system performance through reduced resource consumption in non-vulnerable areas.
3Reliability
If static analysis is performed on entire executable to identify all vulnerabilities, then comprehensive security coverage is achieved, but analysis time and computational cost increase
Solution Approach 1:
The patent segments the executable into different portions based on vulnerability characteristics identified through static analysis. Instead of applying uniform high precision monitoring to the entire executable, the system divides it into vulnerable portions (requiring high precision) and non-vulnerable portions (acceptable for low precision monitoring). This segmentation resolves the contradiction by maintaining comprehensive security coverage over vulnerable areas while reducing analysis time and computational cost by excluding non-vulnerable areas from intensive monitoring.
4Measurement precision
If uniform high precision monitoring is applied throughout the executable, then all security vulnerabilities are detected, but false positives increase leading to unnecessary security interventions
Solution Approach 1:
The patent applies high precision monitoring locally only to portions of the executable identified as vulnerable through static analysis, rather than uniformly across the entire executable. This local application of high precision monitoring ensures that vulnerabilities are detected with high accuracy while avoiding the generation of false positives in non-vulnerable portions, thereby reducing unnecessary security interventions while maintaining detection precision where it matters most.
Data Source
AI summary
Preliminary program analysis of an executable may be performed. A security vulnerability level of a portion of the executable may be determined based on the preliminary program analysis. The security vulnerability level of the portion may be compared to a security vulnerability threshold. The precision of runtime monitoring of the portion may be tuned based on the comparison.