Exploit prevention based on generation of random chaotic execution context
AssigneeSeraphic Algorithms Ltd.
InventorAvihay Cohen
Life of this patent
Estimating the term…
Abstract
A non-transitory computer readable medium containing instructions that when executed by at least one processor cause the at least one processor to perform cybersecurity operations. The cybersecurity operations may involve determining that an operating system has initiated a computing process, and replacing the computing process with a code configured to create a map representing a structure of an original binary image associated with the replaced computing process. A modified execution context may be generated for the computing process and the original binary image may be recompiled into an execution binary image compatible with the modified execution context. The computing process may then be executed using the execution binary image and the map.
Claims20
A non-transitory computer readable medium containing instructions that when executed by at least one processor cause the at least one processor to perform cybersecurity operations comprising:
- determining that an operating system has initiated a computing process;
- replacing the computing process with an executable code configured to create a map representing a structure of an original binary image associated with the replaced computing process;
- generating a modified execution context for the replaced computing process, wherein at least one of a datum, an instruction, a register, or a location is replaced with a corresponding datum, instruction, register, and location associated with the modified execution context;
- recompiling the original binary image into an execution binary image that includes the map and is compatible with the modified execution context;
- and
- executing the replaced computing process using the execution binary image and the map.
A method for performing cybersecurity operations comprising:
- determining that an operating system has initiated a computing process;
- replacing the computing process with an executable configured to obtain a map representing a structure of an original binary image associated with the replaced computing process;
- obtaining a modified execution context generated for the replaced computing process, wherein at least one of a datum, an instruction, a register, or a location is replaced with a corresponding datum, instruction, register, and location associated with the modified execution context;
- recompiling the original binary image into an execution binary image that includes the map and is compatible with the modified execution context;
- and
- executing the replaced computing process using the execution binary image and the map.
A system for performing cybersecurity operations, comprising:
- at least one processor configured to:
- determine that an operating system has initiated a computing process;
- replace the computing process with an executable configured to create a map representing a structure of an original binary image associated with the replaced computing process;
- generate a modified execution context for the replaced computing process, wherein at least one of a datum, an instruction, a register, or a location is replaced with a corresponding datum, instruction, register, and location associated with the modified execution context;
- recompile the original binary image into an execution binary image that includes the map and is compatible with the modified execution context;
- and
- execute the replaced computing process using the execution binary image and the map.
Dependencies are inferred from the claim text.