Abstract: Systems and methods for significantly disrupting both the execution and distribution capabilities of computer viruses across computer networks and devices are provided. According to one embodiment, an attempt to execute a computer program is detected by a monitoring process running on a computer system. Responsive thereto, the computer program is transformed from a locally unique form into an executable form using a diversity mechanism. In the locally unique form, semantics of the computer program are in an altered state based on the diversity mechanism. Execution of the locally unique form will fail to perform as intended unless the locally unique form is first or concurrently transformed, using the diversity mechanism, into the executable form having correct semantics. Use of the diversity mechanism differentiates an execution or loading environment of the computer system from other computer systems by affecting operational behavior of computer programs attempting to execute on the computer system.

Abstract: Systems and methods for significantly disrupting both the execution and distribution capabilities of computer viruses across computer networks and devices are provided. According to one embodiment, a computer program is installed within a computer system in a locally unique form having altered semantics based on a diversity mechanism. Execution of the computer program will fail to perform as intended on the computer system unless the locally unique form of the computer program is first transformed into an executable form of the computer program having correct semantics using the diversity mechanism. Use of the diversity mechanism differentiates an execution or loading environment associated with the computer system from that of other computer systems by affecting operational behavior of computer programs attempting to execute on the computer system. Responsive to an attempted execution of the computer program, it is transformed into the executable form by a protected pre-execution process.