Software Tamper Detection via Behavioral Pattern Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software protection mechanisms fail to detect tampering, such as unauthorized code insertion or screen capturing, outside the intended context, as they cannot easily differentiate between normal and abnormal operational behavior.
Innovation Solution
A method and system that monitor system-level calls to gather data on predetermined traits, create fingerprints using Chaos Game Representations, and compare them to identified normal patterns to detect abnormal behavior, allowing for real-time tampering detection and appropriate actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software protection mechanisms are implemented, then software integrity is improved, but the ability to detect tampering outside intended context deteriorates
Solution Approach 1:
The system performs preliminary action by establishing a baseline of normal software behavior patterns before tampering occurs. It continuously monitors system calls and operational characteristics, creating a reference profile that enables future detection of deviations. This preliminary characterization of normal behavior is what allows the system to detect tampering when it occurs.
Solution Approach 2:
The system implements feedback by continuously monitoring actual software behavior and comparing it against the established normal patterns. When deviations are detected, the system provides feedback signals that can trigger alerts or actions. This closed-loop feedback mechanism enables real-time detection of tampering activities.
2Loss of information
If monitoring of system-level calls is implemented, then tamper evidence gathering is improved, but device complexity increases
Solution Approach 1:
The system extracts only the essential information needed for tamper detection from the complex stream of system calls. Instead of monitoring every system call in detail, it selectively extracts specific operational characteristics and behavioral patterns that are indicative of normal versus abnormal behavior. This extraction approach reduces complexity while maintaining detection effectiveness.
Solution Approach 2:
The monitoring system is segmented into distinct functional components: system call interception module, pattern analysis module, comparison module, and alert generation module. This segmentation allows each component to handle specific tasks independently, reducing overall system complexity while maintaining comprehensive monitoring capability.
Data Source
AI summary
A method and system are directed to differentiating between normal characteristics and abnormal characteristics within a software process, such that tampering of the software process may be identified programmatically. The identification of behavior that may be defined as normal may vary. Such behavior may include a sequence of selected system level calls that may access resources considered relevant, and the like. Data on the selected behavior is gathered, and when a sufficient amount of abnormal behavior has been detected, a signal may be provided such that an action may be performed. Samples of the gathered data are assigned a unique value. Statistical information is determined from the collected behavior, including trend data. Such trend data is compared to trends identified as normal for the software process, and a determination is made whether the sampled behavior is non-normal.