Selective Virtualization for Malicious Code Isolation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security methods, such as signature-based detection and preemptive prevention, are inadequate in blocking malicious codes, especially zero-day attacks and variants, and often require user intervention, which can lead to discomfort and ineffective protection against personal information leaks.
Innovation Solution
The use of selective virtualization to execute vulnerable programs in a separate space, where only compulsory resources are virtualized, and suspicious activities are monitored to determine and block malicious codes, preventing access to personal information and administrator rights.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection method is used, then known malicious codes can be blocked, but zero-day attacks and variants cannot be detected
Solution Approach 1:
The patent performs preliminary analysis of program activities before execution to detect malicious codes. By analyzing the activity sequence and characteristics in advance, the system can identify malicious patterns without relying on pre-existing signatures, thus protecting against zero-day attacks and variants while maintaining detection accuracy.
Solution Approach 2:
The patent introduces an intermediary analysis layer between the program and the system resources. This intermediary monitors and analyzes program activities, serving as a mediator that detects malicious behavior patterns without requiring direct interaction with the malicious code or pre-existing signatures, thereby enhancing protection against unknown threats.
2Reliability
If preemptive prevention method is used, then suspicious activities can be detected, but user comfort deteriorates due to frequent notification windows
Solution Approach 1:
The patent enables the system to automatically analyze and determine malicious code presence without requiring user intervention. The comprehensive activity analysis and automated decision-making process eliminates the need for frequent notification windows, maintaining high security detection capability while significantly improving user comfort by allowing uninterrupted program execution.
Solution Approach 2:
The patent implements comprehensive monitoring and analysis of program activities with automated feedback mechanisms. The system continuously analyzes activity patterns and automatically responds to detected threats, providing feedback loops that enable reliable detection without requiring user interaction, thus resolving the contradiction between security detection and user comfort.
3Reliability
If comprehensive virtualization is used, then all resources are protected, but system performance deteriorates due to overhead
Solution Approach 1:
The patent applies virtualization selectively only to specific resources that are critical for malicious code execution, rather than comprehensively virtualizing all resources. By identifying and virtualizing only the essential resources (such as registry, files, network), the system achieves effective resource protection while minimizing the performance overhead associated with comprehensive virtualization.
Solution Approach 2:
The patent segments the resource protection approach by dividing resources into categories and applying virtualization only to specific segments that are most vulnerable to malicious code. This segmented approach allows the system to protect critical resources effectively while avoiding the performance penalty of virtualizing non-critical resources, thus maintaining system productivity.
4Reliability
If selective virtualization is used, then personal information protection is enhanced, but resource access complexity increases
Solution Approach 1:
The patent extracts and isolates personal information resources from the general resource pool, creating a separate protected space for sensitive data. By taking out personal information resources and applying selective virtualization only to these extracted resources, the system enhances personal information protection while managing access control complexity through focused rather than comprehensive virtualization.
Data Source
AI summary
In an apparatus and method for protecting resources of a computing system from a malicious code by selective virtualization, at least a part of the resources is classified as compulsory resources for executing a program on the computing system. When a vulnerable program executed in a separate space attempts to access one of the compulsory resources, an operating system level virtualization is performed. Further, when the vulnerable program attempts to access one of the resources of the computing system which is other than the compulsory resources, the vulnerable program is permitted to access a modified resource which is generated by modifying content of the resource.