Security Module Wrapping Application Functions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for detecting and preventing malicious exploits in applications are ineffective due to classical obfuscation and encryption techniques used by attackers, leading to difficulties in blocking exploits without terminating the vulnerable application.
Innovation Solution
A computer system that utilizes native error handling functionality by analyzing potential exploits and throwing a security violation exception, which is caught by an exception handler to activate the application's native error handling, allowing the application to continue running normally while blocking the exploit.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If intrusion detection system scans network traffic to detect malicious code, then detection capability is improved, but attackers can evade detection using obfuscation and encryption techniques
Solution Approach 1:
The patent introduces a security module as an intermediary between the network traffic and the application. This module intercepts inputs before they reach the application, analyzes them for malicious code, and blocks exploits at the application level rather than relying solely on network-based detection that can be evaded through obfuscation
Solution Approach 2:
The security module performs preliminary analysis of inputs before the application processes them. By wrapping application functions and analyzing inputs in advance, the system detects and blocks malicious code before it can execute, preventing the need for post-detection responses
2Measurement precision
If application-level detection is used to detect exploits, then detection accuracy is improved, but the application may need to be terminated to block the exploit
Solution Approach 1:
The patent extracts the security detection functionality from the application itself by introducing a separate security module that wraps application functions. This allows the security analysis to be performed independently, enabling the application to continue running while malicious inputs are blocked at the wrapper level
Solution Approach 2:
The security module acts as an intermediary layer between the application and malicious inputs. By wrapping application functions with security checks, it enables precise detection of exploits while allowing the application to maintain normal operation for legitimate inputs, thus preserving application continuity
Data Source
AI summary
A security module detects attempted exploitations of vulnerabilities of an application executing on a computer. A robust function of the application having native error handling functionality is identified. The security module wraps the robust function with an exception handler that catches a “security violation” exception. The exception handler returns an error code of a type that is handled by the application's native error handling functionality. The security module also hooks the application. When a hook is followed, the security module determines whether a vulnerability in the application is being exploited. If an attempted exploit is detected, the security module throws the security violation exception. The application's native error handling functionality unwinds the call stack for the application until it reaches the exception handler wrapping the robust function. The exception handler catches the security violation exception and returns the error code to the application's native error handling functionality.