Software Protection Segmentation for Availability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing protective schemes for computer software often falsely detect benign programs with bad properties as malicious, leading to interruptions in normal program execution and system availability issues, as they struggle to differentiate between true security events and spurious events caused by incompatibilities or interoperability problems.
Innovation Solution
The proposed solution involves a computer-implemented method that monitors protected software in a testing environment to detect security events, classifies them as learned or unlearned, and implements remediation actions, allowing benign programs to continue running while stopping malicious activity by distinguishing between spurious and true security events through a 0-touch and 1-touch detection mechanism.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If protective schemes enforce coding conventions to protect software, then security is improved, but benign programs with bad properties are falsely detected as attacks, causing system availability to deteriorate
Solution Approach 1:
The protective scheme is segmented into multiple layers: a testing environment for detecting security events, a classification mechanism for distinguishing benign from malicious events, and a production environment for executing protected software. This segmentation allows the system to maintain security checks while preventing false positives from disrupting normal operations.
Solution Approach 2:
The system performs preliminary detection and classification of security events in a testing environment before the protected software runs in production. By pre-identifying benign programs with bad properties and classifying their security events as non-threatening, the system avoids interrupting their execution in the production environment, thus maintaining system availability while preserving security protection.
2Reliability
If protective schemes interrupt execution of falsely detected programs, then security is improved, but system availability deteriorates due to interruptions in normal program execution
Solution Approach 1:
The system implements a feedback mechanism where security events are monitored, classified, and used to update the protection system's understanding of benign versus malicious behavior. By feeding back classification results about programs with bad properties, the system learns to distinguish them from actual attacks, allowing continuous execution of benign programs while maintaining security monitoring.
3Measurement precision
If protective schemes monitor all security events, then detection precision is improved, but false positives increase when benign programs with bad properties are detected
Solution Approach 1:
The system applies different quality standards to different types of security events. Instead of treating all security events uniformly, it classifies them based on their characteristics and context, applying local quality assessment to distinguish between events from benign programs with bad properties and events from actual malicious attacks. This allows precise detection without generating false positives.
Data Source
AI summary
Protected software, such as an application and/or DLL, is monitored by protective software to guard against attacks, while distinguishing spurious, benign events from attacks. In a 1-touch approach, the protected software is monitored in a testing environment to detect spurious, benign events caused by, e.g., incompatibility or interoperability problems. The spurious events can be remediated in different ways, such as by applying a relaxed security policy. In a production mode, or 0-touch mode, when the protected software is subject to attacks, the corresponding remediation can be applied when the spurious events are again detected. Security events which occur in production mode can also be treated as benign when they occur within a specified time window. The applications and/or DLLs can further be classified according to whether they are known to have bad properties, known to be well-behaved, or unknown. Appropriate treatment is provided based on the classification.