Abstract: Systems and methods for significantly disrupting both the execution and distribution capabilities of computer viruses across computer networks and devices are provided. According to one embodiment, an attempt to execute a computer program is detected by a monitoring process running on a computer system. Responsive thereto, the computer program is transformed from a locally unique form into an executable form using a diversity mechanism. In the locally unique form, semantics of the computer program are in an altered state based on the diversity mechanism. Execution of the locally unique form will fail to perform as intended unless the locally unique form is first or concurrently transformed, using the diversity mechanism, into the executable form having correct semantics. Use of the diversity mechanism differentiates an execution or loading environment of the computer system from other computer systems by affecting operational behavior of computer programs attempting to execute on the computer system.

Abstract: Systems and methods for significantly disrupting both the execution and distribution capabilities of computer viruses across computer networks and devices are provided. According to one embodiment, a computer program is installed within a computer system in a locally unique form having altered semantics based on a diversity mechanism. Execution of the computer program will fail to perform as intended on the computer system unless the locally unique form of the computer program is first transformed into an executable form of the computer program having correct semantics using the diversity mechanism. Use of the diversity mechanism differentiates an execution or loading environment associated with the computer system from that of other computer systems by affecting operational behavior of computer programs attempting to execute on the computer system. Responsive to an attempted execution of the computer program, it is transformed into the executable form by a protected pre-execution process.

Abstract: A method for parsing and executing a software program includes receiving a portion of a software program in an original linguistic form, wherein the portion of the software program includes a nonlinear program element having a body, and, while retaining the original linguistic form, directly executing the nonlinear program element by manipulating a parse state and an input stream of tokens representing the body of the nonlinear program element, wherein directly executing comprises executing tokens until the dynamic end of the nonlinear program element is reached. A system includes a tokenizer operable to tokenize the software program and a parser operable to directly execute a nonlinear program element in the software program by manipulating a parse state and an input stream of tokens representing the body of the nonlinear program element, while preserving the original linguistic form of the software program.

Abstract: Systems and methods for significantly disrupting both the execution and distribution capabilities of computer viruses across computer networks and devices are provided. According to one embodiment, a computer program is installed within a computer system in a locally unique form having altered semantics based on a diversity mechanism. Execution of the computer program will fail to perform as intended on the computer system unless the locally unique form of the computer program is first transformed into an executable form of the computer program having correct semantics using the diversity mechanism. Use of the diversity mechanism differentiates an execution or loading environment associated with the computer system from that of other computer systems by affecting operational behavior of computer programs attempting to execute on the computer system. Responsive to an attempted execution of the computer program, it is transformed into the executable form by a protected pre-execution process.

Abstract: Systems and methods for disrupting the operational capabilities and the distribution capabilities of computer viruses are provided. According to one embodiment, an execution environment is created that makes a computer system appear unique to incoming viruses. Responsive to installation of a valid program, the program is registered for execution by transforming it from an executable form into a locally unique form based on a diversity mechanism. Responsive to detecting an attempted execution of a program and prior to execution of the program, it is transformed by causing a protected pre-execution process of the computer system, which implements the diversity mechanism in the form of an inverse transform, to be applied. If the program was previously validly registered, then the transformation based on the diversity mechanism results in an executable program that will execute properly on the computer system; otherwise the transformation results in an executable program that will fail to correctly execute.

Abstract: A system for disrupting malware includes a transform function and its inverse transform function which, when applied serially to an original bit pattern will return the original bit pattern, but when applied in solo will result in a bit pattern which is different than the original bit pattern, a preprocessor configured to apply the transform function in order to transform each benign program received from the computer-readable medium from an architecturally standardized form into a locally-specific form prior to storage of the program code in the program memory; a postprocessor configured to apply the inverse transform function in order to inversely transform all programs prior to their execution, such that previously transformed benign programs are converted back to the architecturally standardized form and malicious programs are rendered dysfunctional for their intended purpose.