Runtime Software State Identification for Targeted Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software protection methods incur significant processing overheads and are often applied universally, even when only a subset of a software application's functionality requires security, leading to inefficient resource utilization and potential performance degradation.
Innovation Solution
A method to identify the current execution state of a software application at runtime, allowing for dynamic toggling of security measures based on the identified state, by generating an executable that collects invocation data for callable units and training an identification algorithm to determine the execution state, enabling targeted application of security protections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If strong software protection methods are applied universally across the entire software application, then security coverage is improved, but processing overhead and resource consumption increase significantly
Solution Approach 1:
The patent divides the software application into multiple execution states and applies protection methods selectively to specific states rather than universally. The system identifies and segments critical execution states where security is most needed, allowing protection resources to be concentrated where they provide maximum security benefit while reducing overhead in less critical states.
Solution Approach 2:
The patent implements dynamic adjustment of protection methods based on the current execution state of the software. The system continuously monitors execution state and adapts the level of protection applied, enabling strong security measures to be activated only when necessary and relaxed when not needed, thereby optimizing the balance between security and performance.
2Reliability
If multiple different protection methods are applied simultaneously to secure different functionalities, then security effectiveness is improved, but system complexity and overhead increase
Solution Approach 1:
The patent dynamically selects and activates specific protection methods based on the identified execution state. Rather than having all protection methods active simultaneously, the system adapts the protection strategy to match the current state, enabling multiple protection approaches to be used selectively without the constant overhead of maintaining all of them active.
Solution Approach 2:
The patent applies different protection methods to different execution states based on their specific security requirements. Each execution state receives a tailored protection approach suited to its characteristics, rather than applying a uniform protection strategy across all states, thereby improving security effectiveness while reducing overall system complexity.
3Difficulty of detecting and measuring
If software protection is applied at operating system level with continuous monitoring, then detection capability is improved, but performance overhead and resource consumption increase
Solution Approach 1:
The patent implements dynamic monitoring intensity adjustment based on execution state. The system monitors software execution continuously but adapts the level of monitoring and detection activities to match the current state, enabling strong detection capability when security threats are most likely while reducing monitoring overhead during safe states to maintain performance.
Solution Approach 2:
The patent segments the monitoring and detection process into state-specific detection routines. Rather than applying a single continuous monitoring approach, the system divides detection activities into state-appropriate levels, enabling comprehensive detection where needed while minimizing detection overhead in less critical states.
Data Source
AI summary
There is described a method of enabling identification of the execution state of an item of software at runtime. The method comprises receiving from one or more clients one or more respective labelled sets of invocation data generated at the one or more clients by the execution of an executable of the item of software configured to cause the collection of invocation data at runtime for one or more callable units of the item of software, wherein each labelled set of invocation data comprises a label indicating an execution state of the item of software during a respective portion of runtime and invocation data corresponding to said respective portion of runtime; training, based on said collection of invocation data, an identification algorithm to identify the execution state of the item of software from collected invocation data of the item of software. There is also described a related method of identifying the execution state of an executable during a portion of runtime, as well as related apparatus and computer programs.