Zero-Day Vulnerability Discovery Without Source Code

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing methods for automatic discovery of software vulnerabilities and exploit generation require access to the source code of the victimized software, limiting their effectiveness, and often rely on manual processes that are inefficient and prone to missing zero-day exploitations.

Innovation Solution

A method employing Monte Carlo simulations and symbolic execution to automatically detect vulnerabilities and generate exploits without requiring access to the source code, using random datasets to identify vulnerabilities and create inputs that can cause software crashes, and then employing dynamic or probabilistic logic to insert malicious code into the execution path.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If source code access is required for automatic vulnerability discovery, then analysis precision is improved, but ease of operation deteriorates

Engineering Contradiction:

Improvevulnerability detection accuracyVSAvoidoperational convenience

Core Design Contradiction:

Measurement precisionVSEase of operation

Solution Approach 1:

The invention extracts the essential analysis requirements from source code dependency. Instead of requiring source code, the system extracts and analyzes runtime behaviors, memory states, and execution flows directly from compiled binaries. This extraction approach maintains vulnerability detection capability while removing the operational barrier of source code access.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent introduces symbolic execution as an intermediary mechanism between the vulnerability analyzer and the target software. This intermediary translates binary execution into analyzable symbolic representations, enabling precision vulnerability detection without direct source code access. The symbolic execution engine acts as a mediator that bridges the gap between binary analysis limitations and vulnerability detection requirements.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If manual vulnerability discovery processes are used, then analysis precision is improved, but productivity deteriorates

Engineering Contradiction:

Improvevulnerability detection accuracyVSAvoiddiscovery efficiency

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The system implements self-service through automated symbolic execution and Monte Carlo simulations. The vulnerability discovery process serves itself by automatically generating test inputs, executing symbolic analysis, and identifying vulnerabilities without human intervention. This automation maintains the precision of systematic analysis while dramatically improving productivity over manual processes.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent applies preliminary action by pre-computing symbolic execution paths and preparing analysis frameworks before actual vulnerability scanning. The system pre-establishes the symbolic execution environment, data flow graphs, and constraint solving mechanisms, enabling rapid automated vulnerability discovery when deployed. This preliminary preparation eliminates the need for manual setup during actual scanning operations.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If traditional exploit generation methods are used, then reliability is improved, but device complexity deteriorates

Engineering Contradiction:

Improveexploit generation reliabilityVSAvoidsystem complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The invention merges vulnerability detection and exploit generation into a single integrated system. The symbolic execution engine simultaneously identifies vulnerabilities and constructs exploits by analyzing the same execution paths and memory states. This merging maintains reliability through consistent analysis while reducing overall system complexity by eliminating the need for separate detection and exploitation tools.

Inventive Principle:

Principle #5Merging (Combining)

Data Source

PatentUS10121008B1Method and process for automatic discovery of zero-day vulnerabilities and expoits without source code access

Publication Date: 2018.11.06 FRECHETTE STEPHEN PATRICK

AI summary

An invention that enables an automatic discovery of Vulnerabilities in software that consists of compiled and linked machine code. Once the vulnerability, i.e., a set of values in a file or memory or network packet that causes unintended execution of commands, is discovered, the invention also automatically creates a set of commands to execute to enable a user to execute unauthorized commands. Through the employment of random input file generation that follows a set of constraints, and symbolic execution that creates solutions in the form of data input sets, which results in the CPU's program counter to execute malicious code, the invention creates novel software vulnerabilities and exploits.