Weak Code Path Injection for Runtime Attack Monitoring

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cybersecurity measures struggle to proactively address software vulnerabilities without human error, and honeypots may not effectively lure malicious actors due to their isolated nature and potential damage prevention mechanisms.

Innovation Solution

Automatically injecting intentionally weak code paths into intermediate software representations, using path profiling to generate unique identifiers, and monitoring these paths during runtime to detect malicious activity.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If traditional honeypots are used to attract malicious actors, then attack monitoring capability is improved, but system isolation and damage prevention mechanisms reduce the effectiveness of luring attackers

Engineering Contradiction:

Improveattack monitoring capabilityVSAvoidhoneypot effectiveness

Core Design Contradiction:

Ease of manufactureVSReliability

Solution Approach 1:

The system segments the monitoring function from the executed code by injecting path identifiers that are separate from the actual code logic. The monitoring system operates independently by checking these identifiers, allowing the honeypot to remain effective without requiring full system isolation.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Path identifiers serve as intermediaries between the executed code and the monitoring system. Instead of direct monitoring that would require system termination, the path identifiers mediate the interaction, allowing indirect observation of code execution paths without compromising system operation or attacker engagement.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Difficulty of detecting and measuring

If code monitoring is performed to detect malicious activity, then security detection capability is improved, but real-time detection without compromising software integrity becomes difficult

Engineering Contradiction:

Improvemalicious activity detectionVSAvoidsoftware integrity

Core Design Contradiction:

Difficulty of detecting and measuringVSReliability

Solution Approach 1:

The system performs preliminary action by injecting path identifiers into the code during compilation or loading, before execution begins. This pre-prepared infrastructure enables real-time monitoring without modifying or compromising the actual code during runtime, maintaining software integrity while enabling detection.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system replaces direct code inspection or interception mechanisms with a substitution approach using path identifiers. Instead of mechanically analyzing or blocking code execution, the monitoring system substitutes direct observation with indirect tracking through identifiers, enabling detection without interfering with code integrity.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS12517806B2Automatic injection of weak code to attract or distract malicious actors

Publication Date: 2026.01.06 ARM LTD

AI summary

A computer implemented method is provided. The computer implemented method includes receiving an intermediate representation of a source code, intentionally injecting a weak code path at a point within the intermediate representation to create a modified intermediate representation, performing a path profiling on the modified intermediate representation to generate a particular path identifier for each path within the modified intermediate representation, and identifying the particular path identifier of the weak code path for use by a monitoring system. A monitoring system is also provided. The monitoring system monitors an executable code during runtime for execution of a path having a particular path identifier corresponding to the injected intentionally weak code path.