Creating a relatively unique environment for computing platforms

Abstract

Systems and methods for significantly disrupting both the execution and distribution capabilities of computer viruses across computer networks and devices are provided. According to one embodiment, an attempt to execute a computer program is detected by a monitoring process running on a computer system. Responsive thereto, the computer program is transformed from a locally unique form into an executable form using a diversity mechanism. In the locally unique form, semantics of the computer program are in an altered state based on the diversity mechanism. Execution of the locally unique form will fail to perform as intended unless the locally unique form is first or concurrently transformed, using the diversity mechanism, into the executable form having correct semantics. Use of the diversity mechanism differentiates an execution or loading environment of the computer system from other computer systems by affecting operational behavior of computer programs attempting to execute on the computer system.

What is claimed is: 
     
         1 . A computer-implemented method comprising:
 detecting, by a monitoring process running on a computer system, an attempt to execute a computer program installed on the computer system;   responsive to said detecting, transforming, by the computer system, the computer program from a locally unique form into an executable form using a diversity mechanism by causing a protected pre-execution process associated with a kernel of an operating system of the computer system to be applied to the computer program;   wherein the computer program was previously installed on the computer system in the locally unique form in which semantics of the computer program have been altered based on the diversity mechanism;   wherein execution of the locally unique form of the computer program will fail to perform as intended on the computer system unless the locally unique form of the computer program is first or concurrently transformed, using the diversity mechanism, into the executable form of the computer program having correct semantics; and   wherein use of the diversity mechanism differentiates an execution or loading environment associated with the computer system from that of other computer systems by affecting operational behavior of computer programs attempting to execute on the computer system.   
     
     
         2 . The method of  claim 1 , further comprising, during installation of the computer program on the computer system, registering, by a registration program of the computer system, the computer program for execution on the computer system by transforming the computer program from the executable form into the locally unique form based on the diversity mechanism. 
     
     
         3 . The method of  claim 1 , further comprising, during installation of the computer program on the computer system, registering, by a registration program resident on a server computer system separate from the computer system, the computer program for execution on the computer system by transforming the computer program from the executable form into the locally unique form based on the diversity mechanism. 
     
     
         4 . The method of  claim 1 , wherein the computer program is delivered in the locally unique form with a corresponding application-specific loader representing the protected pre-execution process. 
     
     
         5 . The method of  claim 1 , wherein the diversity mechanism involves resequencing of executable instructions of the computer program. 
     
     
         6 . The method of  claim 5 , further comprising periodically resequencing the executable instructions of the computer program based on different sets of resequencing parameters. 
     
     
         7 . The method of  claim 5 , wherein the resequencing is based on a computer system centric template, with an initial sequence offset based upon a characteristic of the computer program modulo a unique element of the computer system. 
     
     
         8 . The method of  claim 1 , wherein the diversity mechanism involves transforming opcodes of executable instructions of the computer program. 
     
     
         9 . The method of  claim 1 , wherein said transforming the computer program from the locally unique form into the executable form using a diversity mechanism occurs prior to execution of the computer program. 
     
     
         10 . The method of  claim 1 , wherein said transforming the computer program from the locally unique form into the executable form using a diversity mechanism takes place during execution of the computer program. 
     
     
         11 . The method of  claim 1 , wherein use of the diversity mechanism is for purposes of reducing exposure to malware. 
     
     
         12 . The method of  claim 1 , wherein use of the diversity mechanism is for purposes of enforcing program licenses. 
     
     
         13 . The method of  claim 1 , wherein use of the diversity mechanism is for the purposes of preventing inappropriate programs from being loaded and executed in a corporate environment. 
     
     
         14 . A non-transitory computer-readable storage medium tangibly embodying a set of instructions, which when executed by one or more processors of one or more computer systems, cause the one or more processors to perform a method comprising:
 detecting, by a monitoring process running on a computer system, an attempt to execute a computer program installed on the computer system;   responsive to said detecting, transforming, by the computer system, the computer program from a locally unique form into an executable form using a diversity mechanism by causing a protected pre-execution process associated with a kernel of an operating system of the computer system to be applied to the computer program;   wherein the computer program was previously installed on the computer system in the locally unique form in which semantics of the computer program have been altered based on the diversity mechanism;   wherein execution of the locally unique form of the computer program will fail to perform as intended on the computer system unless the locally unique form of the computer program is first or concurrently transformed, using the diversity mechanism, into the executable form of the computer program having correct semantics; and   wherein use of the diversity mechanism differentiates an execution or loading environment associated with the computer system from that of other computer systems by affecting operational behavior of computer programs attempting to execute on the computer system.   
     
     
         15 . The non-transitory computer-readable storage medium of  claim 14 , wherein the method further comprises, during installation of the computer program on the computer system, registering, by a registration program of the computer system, the computer program for execution on the computer system by transforming the computer program from the executable form into the locally unique form based on the diversity mechanism. 
     
     
         16 . The non-transitory computer-readable storage medium of  claim 14 , wherein the computer program is delivered in the locally unique form with a corresponding application-specific loader representing the protected pre-execution process. 
     
     
         17 . The non-transitory computer-readable storage medium of  claim 14 , wherein the diversity mechanism involves resequencing of executable instructions of the computer program. 
     
     
         18 . The non-transitory computer-readable storage medium of  claim 17 , wherein the method further comprises periodically resequencing the executable instructions of the computer program based on different sets of resequencing parameters. 
     
     
         19 . The non-transitory computer-readable storage medium of  claim 17 , wherein the resequencing is based on a computer system centric template, with an initial sequence offset based upon a characteristic of the computer program modulo a unique element of the computer system. 
     
     
         20 . The non-transitory computer-readable storage medium of  claim 14 , wherein the diversity mechanism involves transforming opcodes of executable instructions of the computer program. 
     
     
         21 . The non-transitory computer-readable storage medium of  claim 14 , wherein said transforming the computer program from the locally unique form into the executable form using a diversity mechanism occurs prior to execution of the computer program. 
     
     
         22 . The non-transitory computer-readable storage medium of  claim 14 , wherein said transforming the computer program from the locally unique form into the executable form using a diversity mechanism takes place during execution of the computer program.