# US 12,216,761 B2 · Dynamic adaptation of memory elements to prevent malicious attacks > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,216,761 B2 - Document ID: US12216761B2 - Status: Granted - Kind: B2 - Application number: 17/689,197 - Filed: 2022-03-08 - Published: 2023-09-28 - Granted: 2025-02-04 - Earliest claimed: 2022-03-08 - Assignees: Denso Corporation - Applicants: Denso Corporation - Inventors: Ameer Kashani; Gopalakrishnan Iyer; Carlos Mora-Golding; Hirofumi Yamashita - Web page: https://patentgrep.com/patent/US12216761B2 ## CPC - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 2221/034: Test or assess a computer or a system - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Systems, methods, and other embodiments described herein relate to adaptable canary values. In one embodiment, a method includes acquiring state information about a program executing within a vehicle. The state information specifies at least a security level of segments of the program. The method includes, responsive to the program satisfying a generating threshold, generating a canary value according to the state information. The method includes inserting the canary value into a memory address associated with the program. ## Claims ### Claim 1 A security system, comprising: one or more processors; and a memory communicably coupled to the one or more processors and storing: a control module including instructions that, when executed by the one or more processors cause the one or more processors to: acquire state information about a program executing within a vehicle, wherein the state information specifies at least a security level of segments of the program; responsive to the program satisfying a generating threshold which includes monitoring for when the program is executing at a location of a canary value as identified via a mapping that indicates a memory address and for a timing interrupt occurring for generating the canary value, generate the canary value according to the state information, the instructions including instructions to select a length of the canary value according to the security level for a respective segment of the segments of the program; and insert the canary value into the memory address associated with the program, wherein the security system is integrated with the vehicle, and wherein the security level is based, at least in part, on at least one of a risk associated with the respective segment and functional safety associated with the respective segment identified from a pre-analysis of the program. ### Claim 2 (depends on 1) The security system of claim 1, wherein the canary value is not encrypted. ### Claim 3 (depends on 1) The security system of claim 1, wherein the control module includes the instructions to insert the canary value including instructions to pause execution of the program, search the memory of the vehicle for the memory address associated with the canary value, and rewrite the respective segment of the segments associated with the canary value to shift the respective segment and update offsets of the program to accommodate the canary value, and wherein the control module includes the instructions to insert the canary value into the program as a mechanism to prevent non-control flow attacks. ### Claim 4 (depends on 1) The security system of claim 1, wherein the control module includes the instructions to insert the canary value including instructions to integrate the canary value into the program at a transition point of a function in the program, or to deconstruct a data object of the program to integrate the canary value within the data object, including a function of the program, and wherein the control module includes the instructions to insert the canary value including instructions to interleave the canary value within instructions of the program. ### Claim 5 (depends on 1) The security system of claim 1, wherein the control module includes the instructions to monitor for the canary value according to an execution state of the program including instructions to compare the canary value from the memory address with a stored canary to determine whether the canary value has been altered. ### Claim 6 (depends on 5) The security system of claim 5, wherein the control module includes the instructions to monitor for the canary value including instructions to check a system interface associated with the memory in which the program is stored for communications offloading the program. ### Claim 7 (depends on 1) The security system of claim 1, wherein the vehicle is an autonomous vehicle. ### Claim 8 A non-transitory computer-readable medium storing instructions that, when executed by one or more processors, cause the one or more processors to: acquire state information about a program executing within a vehicle, wherein the state information specifies at least a security level of segments of the program; responsive to the program satisfying a generating threshold which includes monitoring for when the program is executing at a location of a canary value as identified via a mapping that indicates a memory address and a timing interrupt occurring for generating the canary value, generate the canary value according to the state information, the instructions including instructions to select a length of the canary value according to the security level for a respective segment of the segments of the program; and insert the canary value into the memory address associated with the program, wherein the one or more processors are integrated with the vehicle, and wherein the security level is based, at least in part, on at least one of a risk associated with the respective segment and functional safety associated with the respective segment identified from a pre-analysis of the program. ### Claim 9 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the canary value is not encrypted. ### Claim 10 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the instructions include instructions to insert the canary value including instructions to pause execution of the program, search memory of the vehicle for the memory address associated with the canary value, and rewrite the respective segment of the segments associated with the canary value to shift the respective segment and update offsets of the program to accommodate the canary value, and wherein the instructions include instructions to insert the canary value into the program as a mechanism to prevent non-control flow attacks. ### Claim 11 (depends on 8) The non-transitory computer-readable medium of claim 8, wherein the instructions include instructions to insert the canary value including instructions to integrate the canary value into the program at a transition point of a function in the program, or to deconstruct a data object of the program to integrate the canary value within the data object, including a function of the program, and wherein the instructions to insert the canary value including instructions to interleave the canary value within instructions of the program. ### Claim 12 A method, comprising: acquiring state information about a program executing within a vehicle, wherein the state information specifies at least a security level of segments of the program; responsive to the program satisfying a generating threshold which includes monitoring for when the program is executing at a location of a canary value as identified via a mapping that indicates a memory address and a timing interrupt occurring for generating the canary value, generating the canary value according to the state information, including selecting a length of the canary value according to the security level for a respective segment of the segments of the program; and inserting the canary value into the memory address associated with the program, wherein the method is executed by one or more processors, wherein the one or more processors are integrated with the vehicle, and wherein the security level is based, at least in part, on at least one of a risk associated with the respective segment and functional safety associated with the respective segment identified from a pre-analysis of the program. ### Claim 13 (depends on 12) The method of claim 12, wherein the canary value is not encrypted. ### Claim 14 (depends on 12) The method of claim 12, wherein satisfying the generating threshold includes at least one of executing the program at a location of the canary value as identified via a mapping that indicates the memory address and encountering a timing interrupt for generating the canary value. ### Claim 15 (depends on 12) The method of claim 12, wherein inserting the canary value includes pausing execution of the program, searching memory of the vehicle for the memory address associated with the canary value, and rewriting the respective segment of the segments associated with the canary value to shift the respective segment and update offsets of the program to accommodate the canary value, and wherein inserting the canary value into the program provides a mechanism to prevent non-control flow attacks. ### Claim 16 (depends on 12) The method of claim 12, wherein inserting the canary value includes integrating the canary value into the program at a transition point of a function in the program, or deconstructing a data object of the program to integrate the canary value within the data object, including a function of the program, wherein inserting the canary value includes interleaving the canary value within instructions of the program. ### Claim 17 (depends on 12) The method of claim 12, further comprising: monitoring for the canary value according to an execution state of the program by comparing the canary value from the memory address with a stored canary to determine whether the canary value has been altered. ### Claim 18 (depends on 17) The method of claim 17, wherein monitoring for the canary value includes checking a system interface associated with memory in which the program is stored for communications offloading the program.