Software defined randomization for the mitigation of unknown vulnerabilities

1 . A computer-implemented method, comprising:

detecting initiation of one or more shared libraries being loaded into a runtime memory of an application;

while the one or more shared libraries are being loaded into the runtime memory, placing, by an endpoint module, randomization code into the runtime memory;

for each respective shared library loaded into the runtime memory:

allocating, via the randomization code, a new segment of runtime memory;

inserting, via the randomization code, a copy of the shared library into the new segment of runtime memory; and

overwriting, via the randomization code, a current segment of runtime memory at which the shared memory is currently stored;

receiving, from a policy module, a customized interval period, wherein the policy module is configured to support one or more policy templates; and

for each instance of the customized interval period while the application is being executed:

pausing the application via the randomization code;

for each respective shared library of code, performing a new iteration of the allocating, inserting and overwriting via the randomization code while the application is paused; and

sending a signal, via the randomization code, to resume the application.

2 . The computer-implemented method of claim 1 , wherein receiving the customized interval period comprises:

receiving the customized interval period from a remote source, wherein customization of the interval period occurred at the remote source.

3 . The computer-implemented method of claim 1 , wherein pausing the application comprises:

setting, via the randomization code, all semaphore function flags of the application to in use flags; and

wherein sending the signal to resume the application comprises:

sending a condition variable signal to waiting condition variables associated with the semaphore function flags.

4 . The computer-implemented method of claim 1 , wherein allocating the new segment of runtime memory comprises:

allocating a first new segment of runtime memory for data of the shared library and a second new segment of runtime memory for code of the shared library, wherein the code and data of the shared library are currently stored at discontinuous segments of runtime memory.

5 . The computer-implemented method of claim 4 , wherein inserting the copy of the shared library of code into the new segment of runtime memory comprises:

inserting a copy of the code of the shared library into the first new segment of runtime memory; and

inserting a copy of the data of the shared library into the second new segment of runtime memory.

6 . The computer-implemented method of claim 4 , further comprising:

identifying, via the randomization code, at least one function pointer in a procedural linkage table in the runtime memory, the identified function pointer associated with a function of the shared library; and

updating a memory location referenced by the identified function pointer in the procedural linkage table, the updated memory location representing a memory location of the function in the first new segment of runtime memory that stores the copy of the code of the shared library.

7 . The computer-implemented method of claim 1 , further comprising enabling manual configuration of one or more security policies via the policy module, wherein the one or more security policies includes setting of the customized interval period.

8 . The computer-implemented method of claim 1 , further comprising displaying, via the policy module, a visualization of endpoint connectivity and performance metrics received from the endpoint module.

9 . The method of claim 1 , wherein the endpoint module is configured to control runtime instrumentation and randomization strategies on an endpoint client computer system, and further serves as a relay to gather security and performance metrics, and wherein the endpoint module proactively injects a custom-built library into a new program such that code from the custom-built library is executed before any code is executed from a host program of the application.

10 . A system comprising one or more processors, and a non-transitory computer-readable medium including one or more sequences of instructions that, when executed by the one or more processors, cause the system to perform operations comprising:

receiving, from a policy module, a customized interval period, wherein the policy module is configured to support one or more policy templates;

detecting initiation of one or more shared libraries being loaded into a runtime memory of an application;

while the one or more shared libraries are being loaded into the runtime memory, placing, by an endpoint module, randomization code into the runtime memory;

for each respective shared library loaded into the runtime memory:

(i) allocating, via the randomization code, a new segment of runtime memory;

(ii) inserting, via the randomization code, a copy of the shared library into the new segment of runtime memory; and

(iii) overwriting, via the randomization code, a current segment of runtime memory at which the shared library is currently stored; and

for each instance of the customized interval period while the application is being executed:

(i) pausing the application via the randomization code;

(ii) for each respective shared library of code, performing a new iteration of the allocating, inserting and overwriting via the randomization code while the application is paused; and

(iii) sending a signal, via the randomization code, to resume the application.

11 . A computer program product comprising a non-transitory computer-readable medium having a computer readable program code embodied therein to be executed by one or more processors, the program code including instructions to:

receiving, from a policy module, a customized interval period, wherein the policy module is configured to support one or more policy templates;

detect initiation of one or more shared libraries being loaded into a runtime memory of an application;

while the one or more shared libraries are being loaded into the runtime memory, place, by an endpoint module, randomization code into the runtime memory;

for each respective shared library loaded into the runtime memory:

(i) allocate via the randomization code, a new segment of runtime memory;

(ii) insert, via the randomization code, a copy of the shared library into the new segment of runtime memory; and

(iii) overwrite, via the randomization code, a current segment of runtime memory at which the shared library is currently stored; and

for each instance of the customized interval period while the application is being executed:

(i) pause the application via the randomization code;

(ii) for each respective shared library of code, perform a new iteration of the allocating, inserting and overwriting via the randomization code while the application is paused; and

(ii) send a signal, via the randomization code, to resume the application.