Trojan Source Code Detection via Rendered Memory Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing methods for detecting Trojan source code, particularly those using the bidirectional algorithm in Unicode, are inefficient and prone to errors as they require manual knowledge of control characters and Unicode layout algorithms, making it difficult to identify malicious code hidden from human review.
Innovation Solution
A computer system loads source code into a first memory and its rendered version into a second memory, determining differences to detect problematic source code, which can include control characters that alter display logic without being visible, and performs actions such as removal or alerting based on predefined criteria.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual detection methods using bidirectional algorithm are used, then detection capability is provided, but detection efficiency is low and error-prone
Solution Approach 1:
The patent replaces manual mechanical review processes with automated computational systems. The bidirectional algorithm is implemented as an automated processing system that compares rendered source code with original source code, eliminating manual inspection while maintaining high detection accuracy through systematic computational analysis of control characters and Unicode layout algorithms.
Solution Approach 2:
The detection system performs self-service by automatically identifying and flagging Trojan source code without requiring external manual intervention. The system loads source code, renders it, compares the rendered output with the original, and autonomously detects discrepancies indicating malicious code, thereby improving both efficiency and reliability.
2Object-generated harmful factors
If control characters are used to alter display logic, then Trojan code can be hidden, but detection becomes more difficult
Solution Approach 1:
The patent introduces an intermediary rendering process that acts as a mediator between the original source code and the final display. By rendering the source code through a controlled environment and comparing it with the original, the system exposes hidden control characters and Unicode manipulation that obfuscate malicious code, making detection straightforward despite the obfuscation attempts.
Solution Approach 2:
The patent metaphorically applies the principle of making invisible changes visible. By rendering source code and comparing visual representations with original text, the system highlights discrepancies caused by control characters and bidirectional algorithm manipulation, effectively 'coloring' or marking previously invisible malicious elements for easy detection.
Data Source
AI summary
A computer implemented method, apparatus, system, and computer program product detects a problematic source code. A computer system loads a source code into a first memory. The computer system loads a rendered source code into a second memory. The rendered source code is a rendered version of the source code. The computer system determines a difference between the source code in the first memory and the rendered source code in the second memory. The computer system determines whether a problematic source code is present within the source code using the difference. The computer system performs a set of actions with respect to the problematic source code in response to determining that the problematic source code is present in the source code. According to other illustrative embodiments, a computer system and a computer program product for detecting a problematic source code are provided.