Software Process Behavior Monitoring with Token-Validated State Transitions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for monitoring software processes are inadequate in detecting unexpected behavior, particularly in interpreted languages, as control-flow integrity techniques are ineffective and access control policies may not provide robust protection against unauthorized program transitions.
Innovation Solution
A method and system for monitoring process behavior by obtaining a profile of a software module, validating identifiers, establishing token associations, and taking actions based on profile data to ensure compliance with expected behavior, including state transitions and policy changes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If control-flow integrity techniques are used to verify control flow, then security against program exploitation is improved, but effectiveness is reduced for interpreted languages because the interpreter itself can be compromised
Solution Approach 1:
The patent introduces a behavior monitoring system as an intermediary layer between the process execution and the security verification. Instead of directly verifying control flow (which fails for interpreted languages), the system monitors high-level behavior patterns through a profile-based approach, effectively bridging the gap between binary CFI techniques and interpreted language security needs
Solution Approach 2:
The patent replaces the mechanical control-flow verification approach (which tracks individual instruction execution paths) with a behavioral monitoring approach that observes high-level process behavior patterns. This substitution allows security verification to work effectively with interpreted languages where the control flow is dynamically generated rather than statically defined
2Reliability
If access control policies like SELinux and seccomp are applied, then system access control is improved, but robustness is reduced against unexpected behavior detection
Solution Approach 1:
The patent implements a feedback mechanism where the behavior monitoring system continuously observes process behavior, compares it against the expected profile, and provides feedback when deviations are detected. This feedback loop enables robust detection of unexpected behavior that goes beyond static access control policies
Solution Approach 2:
The system performs preliminary action by establishing an expected behavior profile before the actual process execution. This pre-defined profile serves as a baseline against which all subsequent behavior is measured, enabling proactive detection of deviations rather than reactive response to security violations
Data Source
AI summary
Methods and systems for monitoring the behavior of a process. A profile of a software module is obtained. An association request is received from a process. The association request includes an identifier. In response to receiving the association request, successfully validating the identifier based on the profile and establishing an association of a token to data associated with the identifier. A disassociation request is received from the process. The disassociation request includes a token. In response to receiving the disassociation request, using the token to retrieve the data associated with the identifier, determining that the disassociation request is invalid based on the profile and the data associated with the identifier, and based on the determination that the disassociation request is invalid, taking an action.