Symbolic Constraint Firewall for Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current solutions for protecting software vulnerabilities are either costly, disruptive, or ineffective, as they often require patch installations, traditional anti-viral software, or firewalls that suffer from false positives and negatives, failing to provide complete and sound protection without human intervention.
Innovation Solution
A system and method that compares patched and unpatched software versions to generate symbolic constraints, which are used to create a firewall that identifies exploitative input without installing the patch, ensuring zero false positives and negatives, and can be automatically deployed at machine speed.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional anti-viral software or firewalls are used, then protection against known malicious software is provided, but false positives and false negatives occur reducing effectiveness
Solution Approach 1:
The patent transforms the detection approach by changing the parameter from signature matching to symbolic constraint evaluation. Instead of comparing input against known malicious signatures, the system generates symbolic constraints from patched code and evaluates whether input satisfies these constraints, fundamentally changing the detection parameter to eliminate false positives and negatives
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a symbolic constraint evaluation system. The old mechanical approach of pattern matching is substituted with a symbolic reasoning approach where constraints are generated from code differences and evaluated against input, achieving precise detection without false results
2Reliability
If software patches are installed to fix vulnerabilities, then protection against exploitation is achieved, but installation cost and business disruption increase
Solution Approach 1:
The patent extracts the protective functionality from the patched software itself. Instead of requiring installation of the entire patched software package, the system extracts only the symbolic constraints representing the security fix and deploys these lightweight constraints independently, eliminating deployment complexity while maintaining protection
Solution Approach 2:
The patent creates a copy of the protective logic in the form of symbolic constraints rather than copying the entire patched software. The constraints capture the essential security logic from the patch without requiring the full software update, enabling rapid deployment without business disruption
3Measurement precision
If symbolic constraints are generated from code comparison, then precise identification of exploitative input is achieved, but computational complexity increases
Solution Approach 1:
The patent segments the vulnerability analysis into distinct phases: code comparison, constraint generation, and constraint evaluation. By dividing the complex process into manageable segments, each handling a specific aspect of the problem, the system achieves high precision without overwhelming computational complexity at any single stage
Data Source
Figure 1
Figure 2
Figure 3A
AI summary
A system and method for identifying and preventing vulnerability exploitation is provided. The system comprises a processor and memory. The memory stores one or more programs comprising instructions to execute a method. The method first comprises comparing a first version of a software module with a second version of a software module. Second, the system determines one or more differences between the first version and the second version. Next, the system represents the one or more differences as symbolic constraints. Last, the system generates a firewall for identifying exploitative input using the symbolic constraints.