Speculative Execution Trap Code for Malicious Activity Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current anti-malware technologies face challenges in detecting malicious code attempting to access protected data stored in system cache, particularly during speculative execution, where sensitive information may be exposed, leading to potential data breaches.

Innovation Solution

Implementing trap code that allocates a trap address range in response to specific commands, adjusting its execution frequency based on detected malicious activity, and disabling speculative execution when threats are identified to prevent unauthorized access and conserve resources.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If trap code is executed frequently to detect malicious code, then detection reliability is improved, but processing resources are consumed

Engineering Contradiction:

Improvedetection reliabilityVSAvoidprocessing resources

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The system dynamically adjusts the frequency of trap code execution based on detected malicious activity patterns. When malicious code is detected, the frequency increases to enhance detection reliability; when no threats are present, the frequency decreases to conserve processing resources. This dynamic adaptation resolves the contradiction between maintaining high detection reliability and reducing resource consumption.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system changes the execution frequency parameter of trap code based on system state. By monitoring for malicious activity and adjusting the frequency parameter accordingly, the system optimizes the balance between detection effectiveness and resource utilization, executing trap code more frequently when threats are detected and less frequently during normal operation.

Inventive Principle:

Principle #35Parameter changes

2Productivity

If speculative execution is enabled to improve processing speed, then productivity is improved, but security vulnerability increases due to potential data breach

Engineering Contradiction:

Improveprocessing speedVSAvoidsecurity vulnerability

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary actions by allocating trap address ranges before speculative execution occurs. This preliminary setup ensures that even if speculative execution accesses memory, it will encounter trap addresses that prevent actual data breaches. The trap code is prepared in advance to catch and prevent unauthorized access during speculative execution, thus maintaining both productivity and security.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The trap code acts as an intermediary between the speculative execution and the actual data in memory. By inserting trap addresses into the execution path, the system creates a protective layer that intercepts any unauthorized access attempts during speculative execution, preventing direct access to sensitive data while allowing the speculative execution to proceed for performance optimization.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Difficulty of detecting and measuring

If trap address range is allocated to detect malicious code, then detection capability is improved, but device complexity increases

Engineering Contradiction:

Improvedetection capabilityVSAvoidsystem complexity

Core Design Contradiction:

Difficulty of detecting and measuringVSDevice complexity

Solution Approach 1:

The system segments the memory space by allocating specific trap address ranges that are distinct from normal application addresses. This segmentation allows the detection system to monitor only the relevant trap ranges for malicious activity rather than analyzing entire memory spaces, improving detection capability while managing complexity through focused monitoring of segmented address regions.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS11755735B2Speculatively executing conditional branches of code when detecting potentially malicious activity

Publication Date: 2023.09.12 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Provided are a computer program product, system, and method for determining a frequency at which to execute trap code in an execution path of a process executing a program to generate a trap address range to detect potential malicious code. Trap code is executed in response to processing a specified type of command in application code to allocate a trap address range used to detect potentially malicious code. A determination is whether to modify a frequency of executing the trap code in response to processing a specified type of command. The frequency of executing the trap code is modified in response to processing the specified type of command in response to determining to determining to modify the frequency of executing the trap code.