# US 2014/0196148 A1 · Methods and systems for preventing security breaches > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0196148 A1 - Document ID: US20140196148A1 - Status: Published application - Kind: A1 - Application number: 14/209,093 - Filed: 2014-03-13 - Published: 2014-07-10 - Earliest claimed: 2007-11-09 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Vishal Chahal - Web page: https://patentgrep.com/patent/US20140196148A1 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - G06F 21/126: {Interacting with the operating system} - G06F 21/54: by adding security routines or objects to programs - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - G06F 9/445: Program loading or initiating (bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57) - G06F 2221/033: Test or assess software - G06F 2221/2149: Restricted operating environment - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A security payload is attached to a received binary executable file. The security payload is adapted to intercept application programming interface (API) calls to system resources from the binary executable file via export address redirection back to the security payload. Upon execution of the binary executable file, the security payload replaces system library export addresses within a process address space for the binary executable file with security monitoring stub addresses to the security payload. Upon the binary executable computer file issuing a call to a given API, the process address space directs the call to the given API back to the security payload via one of the security monitoring stub addresses that is associated with the given API. The security payload then can assess whether the call to the given API is a security breach. ## Claims ### Claim 1 A method for improving security of a binary executable file by using a security payload, the method comprising: receiving the binary executable file; attaching the security payload to the binary executable file, including embedding the security payload into the binary executable file in a reversible manner, the security payload adapted to intercept application programming interface (API) calls to system resources from the binary executable file via export address redirection back to the security payload; and distributing the binary executable file within which the security payload has been embedded over a network to a target computing system, such that upon execution of the binary executable file at the target computing system, the security payload replacing system library export addresses within a process address space for the binary executable computer file with security monitoring stub addresses to the security payload, the API calls associated with the system library export addresses within the process address space. ### Claim 2 (depends on 1) The method of claim 1, further comprising, upon the binary executable file issuing the call to the given API: upon the binary executable file issuing a call to a given API, the process address space directing the call to the given API back to the security payload via one of the security monitoring stub addresses that is associated with the given API; and, the security payload assessing whether the call to the given API is a security breach. ### Claim 3 (depends on 2) The method of claim 2, further comprising upon the binary executable file issuing the call to the given API: where the call to the given API is not a security breach, passing through the call to the given API to the system resources; and, where the call to the given API is a security breach, performing one or more security breach-related actions. ### Claim 4 (depends on 1) The method of claim 1, wherein attaching the security payload to the binary executable file is such that the binary executable file remains a valid binary executable file that is capable of being executed even after the security payload has been attached to the binary executable file. ### Claim 5 (depends on 1) The method of claim 1, wherein attaching the security payload to the binary executable file further comprises initially mapping the binary executable file to virtual memory of a system in relation to which the method is performed. ### Claim 6 (depends on 1) The method of claim 1, wherein receiving the binary executable file is performed by a first computer program running on a system in relation to which the method is performed, and attaching the security payload to the binary executable file is performed by a second computer program that is a plug-in computer program for the first computer program. ### Claim 7 (depends on 1) The method of claim 1, wherein attaching the security payload to the binary executable file is performed statically, prior to execution of the binary executable file. ### Claim 8 (depends on 1) The method of claim 1, wherein the security payload replacing the system library export addresses within the process address space for the binary executable file with the security monitoring stub addresses to the security payload is performed dynamically, at time of execution of the binary executable file. ### Claim 9 (depends on 1) The method of claim 1, wherein the security payload assessing whether the call to the given API is a security breach comprises the security payload analyzing the call to the given API against one or more predetermined security-related policies. ### Claim 10 (depends on 1) The method of claim 1, wherein attaching the security payload to the binary executable file further comprises: increasing a number of sections value of the binary executable file by one to accommodate the security payload embedded within the binary executable file; and, adding the security payload to an end of the binary executable file. ### Claim 11 A non-transitory computer-readable data storage medium storing a computer program executable by a processor to perform a method for improving security of a binary executable file by using a security payload, the method comprising: receiving the binary executable file; attaching the security payload to the binary executable file by statically embedding the binary executable file in a reversible manner prior to execution of the binary executable file at and distribution of the binary executable file to a target computing system, the security payload adapted to intercept application programming interface (API) calls to system resources from the binary executable file via export address redirection back to the security payload; and distributing the binary executable file within which the security payload has been embedded to the target computing system over a network, such that upon execution of the binary executable file at the target computing system, the security payload replacing system library export addresses within a process address space for the binary executable computer file with security monitoring stub addresses to the security payload, the API calls associated with the system library export addresses within the process address space, wherein the security payload replacing the system library export addresses within the process address space for the binary executable file with the security monitoring stub addresses to the security payload comprises locating a base address to a system library within the process address space for the binary executable file, the system library encompassing the system resources. ### Claim 12 (depends on 11) The computer-readable data storage medium of claim 11, wherein the process address space directing the call to the given API back to the security payload via one of the security monitoring stub addresses that is associated with the given API comprises the call to the given API resolving to one of the security monitoring stub addresses that is associated with the given API, such that control passes to the security payload. ### Claim 13 A system comprising: hardware comprising at least one or more of processors, memory, and storage devices; an application running on the hardware and adapted to receive a binary executable file; a plug-in for the application, the plug-in running on the hardware and adapted to attach security payload to the binary executable computer file in a reversible manner, the security payload adapted to intercept application programming interface (API) calls to system resources from the binary executable file via export address redirection back to the security payload, such that upon execution of the binary executable file by the hardware of the system, the security payload replaces system library export addresses within a process address space for the binary executable file with security monitoring stub addresses to the security payload, the API calls associated with the system library export addresses within the process address space. ### Claim 14 (depends on 13) The system of claim 13, wherein, upon the binary executable file issuing a call to a given API, the process address space directs the call to the given API back to the security payload via one of the security monitoring stub addresses that is associated with the given API; the security payload assesses whether the call to the given API is a security breach; where the call to the given API is not a security breach, the security payload passes through the call to the given API to the system resources; and, where the call to the given API is a security breach, the security payload performs one or more security breach-related actions ### Claim 15 (depends on 13) The system of claim 13, wherein the plug-in attaches the security payload to the binary executable computer file by further: increasing a number of sections value of the binary executable file by one to accommodate the security payload embedded within the binary executable file; and, adding the security payload to an end of the binary executable file. ### Claim 16 (depends on 13) The system of claim 13, wherein the security payload replaces the system library export addresses within the process address space for the binary executable file with the security monitoring stub addresses to the security payload by: acquiring an address of the process address space for the binary executable file; locating a base address to a system library within the process address space for the binary executable file, the system library encompassing the system resources; from the base address to the system library, locating addresses for API's within the system library; copying the addresses for the API's within the system library to the security payload; and, replacing the addresses for the API's within the system library with the security monitoring stub addresses to the security payload. ### Claim 17 (depends on 11) The computer-readable data storage medium of claim 11, wherein the method further comprises, upon the binary executable file issuing the call to the given API: upon the binary executable file issuing a call to a given API, the process address space directing the call to the given API back to the security payload via one of the security monitoring stub addresses that is associated with the given API; and, the security payload assessing whether the call to the given API is a security breach. ### Claim 18 (depends on 11) The computer-readable data storage medium of claim 11, wherein attaching the security payload to the binary executable file is such that the binary executable file remains a valid binary executable file that is capable of being executed even after the security payload has been attached to the binary executable file. ### Claim 19 (depends on 11) The computer-readable data storage medium of claim 11, wherein attaching the security payload to the binary executable file further comprises initially mapping the binary executable file to virtual memory of a system in relation to which the method is performed. ### Claim 20 (depends on 11) The computer-readable data storage medium of claim 11, wherein the security payload replacing the system library export addresses within the process address space for the binary executable file with the security monitoring stub addresses to the security payload further comprises: acquiring an address of the process address space for the binary executable file; from the base address to the system library, locating addresses the for the API's within the system library; copying the addresses for the API's within the system library to the security payload; and, replacing addresses for API's within the system library with the security monitoring stub addresses to the security payload.