Software Exploitation Detection via Stack Pointer Validation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to effectively detect software exploitation, such as malware and viruses, which exploit security defects in applications like web browsers or email readers, posing a risk to user data and system control.
Innovation Solution
A method that involves gathering information about processes and threads on a computing device, monitoring instructions, examining stack pointers, valid subroutine calls, and executable code locations to identify potential software exploitation by analyzing stack contents and exception handlers, and determining if certain functions like CreateProcess or LoadLibrary are called.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If real-time monitoring and analysis of processes and threads is implemented to detect software exploitation, then detection capability is improved, but device complexity increases
Solution Approach 1:
The patent applies preliminary action by pre-establishing detection mechanisms that monitor specific exploitation patterns before actual attacks occur. Thread information blocks are pre-configured with stack pointer validation rules, and exception handler chains are pre-analyzed for malicious patterns. This allows the system to detect exploitation attempts in real-time without requiring complex post-attack analysis, thereby improving detection capability while managing system complexity through proactive rather than reactive monitoring.
2Measurement precision
If comprehensive analysis of stack pointers and exception handlers is performed to identify exploitation, then measurement precision is improved, but loss of time increases
Solution Approach 1:
The patent applies local quality by focusing analysis on specific critical regions rather than performing comprehensive system-wide scanning. Thread information blocks contain localized stack pointer values and exception handler addresses that are specifically analyzed for exploitation patterns. The exception handler chain analysis concentrates on validating addresses within the chain rather than examining all system memory. This targeted approach maintains high detection accuracy while minimizing analysis time by examining only the most relevant local structures.
3Reliability
If multiple detection steps including process creation monitoring and library loading analysis are implemented, then reliability of detection is improved, but device complexity increases
Solution Approach 1:
The patent applies segmentation by dividing the detection system into distinct functional modules: process creation monitoring, library loading analysis, stack pointer validation, and exception handler chain analysis. Each module independently monitors a specific aspect of system execution and contributes to overall detection reliability. This modular architecture improves reliability through comprehensive multi-point monitoring while managing complexity by organizing detection functions into separate, manageable segments that can be implemented and maintained independently.
Data Source
AI summary
A method for detecting software exploitation broadly comprises the steps of gathering information about processes and threads executing on a computing device, monitoring instructions executed by a thread that is currently running, performing the following steps if a function to create a process or a function to load a library is called, examining a thread information block, determining whether an address included in a stack pointer of the thread is in a range of addresses for a stack specified by the thread information block, and determining whether a first plurality of no-operation instructions is followed by shell code that is followed by a second plurality of no-operation instructions.