Runtime Software Module Tracking via Interposition Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer security systems lack effective runtime detection mechanisms for active software modules, which hampers the ability to monitor and manage software loads dynamically and securely.
Innovation Solution
A computer system and method that utilize interposition functions to detect and identify software modules being loaded or unloaded within an application framework, creating a runtime software bill-of-materials (RBOM) that tracks active software modules.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If interposition functions are used to detect software module loading, then runtime detection capability is improved, but system complexity increases
Solution Approach 1:
The patent introduces interposition functions as intermediary components that sit between the application framework and the operating system. These interposition functions intercept software module loading requests, extract module information, and pass it to the RBOM generator. This intermediary layer enables precise runtime detection without requiring direct modification of the application framework or OS kernel, thus improving detection capability while containing system complexity.
2Reliability
If runtime monitoring of all software modules is implemented, then security detection capability is improved, but processing overhead increases
Solution Approach 1:
The patent extracts only the essential information needed for security monitoring from the software module loading process. The interposition functions selectively capture module identifiers, version information, and loading context, ignoring unnecessary data. This extraction approach enables comprehensive security monitoring while minimizing processing overhead by focusing only on critical security-relevant parameters.
Solution Approach 2:
The system implements partial monitoring by focusing on specific high-risk module loading events rather than analyzing every single module load operation. The interposition functions are configured to monitor critical application frameworks and sensitive module types, applying excessive action only where security risks are highest, thus balancing detection capability with processing efficiency.
3Ease of operation
If comprehensive software module tracking is implemented, then system management capability is improved, but data processing requirements increase
Solution Approach 1:
The patent merges the collection, processing, and analysis of software module information into a unified RBOM generation process. The interposition functions collect module data, which is then consolidated and processed by the RBOM generator to create a comprehensive runtime software bill of materials. This merged approach improves system management capability by providing a centralized view of all active modules while efficiently processing data through an integrated pipeline.
Solution Approach 2:
The system performs preliminary processing of module information at the point of collection. The interposition functions pre-process module data by extracting key identifiers and categorizing modules as they are loaded, before passing this pre-processed information to the RBOM generator. This preliminary action reduces the data processing burden on subsequent system management components and enables faster generation of the runtime software bill of materials.
Data Source
AI summary
A method of runtime identification of loading/unloading of a software-module, the method comprising performing at least one of: a) detecting, by a loading interposition function, an invocation of a first function associated with loading of software-modules, and identifying a software-module being loaded, utilizing at least one of: i) parameter data supplied in the invocation of the first function, ii) context of an operating system process invoking the first function, and iii) data stored prior invocations of functions associated with loading of software-modules; and b) detecting, by an unloading interposition function, an invocation of a second function associated with unloading of software-modules, and identifying a software-module being unloaded utilizing at least one of: i) parameter data supplied in the invocation of the second function, ii) context of an operating system process invoking the second function, and iii) data stored in prior invocations of functions associated with loading and/or unloading of software.