Dynamic runtime micro-segmentation of interpreted languages

1 . A method for monitoring execution of a software program in first process by a host computer, the software program is programmed in an interpreter-based language, the software program incorporates a software library, the host computer is executing an operating system having a kernel and provisioning distinct processing spaces to different executed programs, the method comprising:

attaching a first program to one or more entry points of functions of the software library, a second program to one or more exit points of the functions of the software library and a third program to system call invocations by the software program, wherein at least one of the first program, the second program and the third program is implemented using an extended Berkeley Packet Filter (eBPF), whereby the eBPF providing observability in kernel mode of the operating system, the first program configured to issue indications of entries to functions, the second program configured to issue indications of exits from functions, the third program is configured to issue indications of system call invocations,

wherein a portion of the first program, the second program and the third program is implemented without using the eBPF, whereby the portion is used to collect information from user mode, whereby reducing overhead associated with mode switching from kernel mode to user mode or vice versa;

receiving, by a monitoring agent, the indications of entries and the indications of exits, the monitoring agent is executed in a second process of the host computer, the second process having a separate processing space than the first process;

based on the indications of entries and the indications of exits, monitoring, by the monitoring agent, a stack trace of the software program, whereby tracking stack state in the separate processing space;

based on the indications of system call invocations and based on the stack trace of the software program, identifying, by the monitoring agent, system call invocations by the software library; and

performing responsive action in response to a determination that a system call invocation deviates from a pre-defined policy of authorized functionalities.

2 . The method of claim 1 , wherein the monitoring agent and the software program are programmed using different programming languages.

3 . The method of claim 1 , wherein the host computer is part of a container orchestration system, wherein the first process executing the software program is a first container of the container orchestration system, wherein the second process is a second container of the container orchestration system.

4 . The method of claim 3 , wherein the host computer executing one or more additional containers, the one or more additional containers are used to execute one or more additional programs, each of the one or more additional programs is attached at runtime with monitoring programs for monitoring entries and exists to functions thereof and to system call invocations therefrom, whereby enabling the monitoring agent to monitor, in a single processing space, a plurality of different stack traces, whereby reducing resource overhead utilized for monitoring stack traces.

5 . The method of claim 1 , wherein stable execution of the software program is not compromised in an event of unexpected termination of the monitoring agent, whereby robust execution of the software program is provided while enabling stack trace monitoring thereof.

6 . The method of claim 1 , wherein the responsive action comprises preventing the system call invocation, whereby enforcing the pre-defined policy.

7 . The method of claim 1 , wherein the responsive action providing a visual display to a user indicating identified security issues associated with a plurality of software libraries including the software library.

8 . The method of claim 1 , wherein the pre-defined policy is defined in a function-granularity or in a library-granularity.

9 . The method of claim 1 , wherein the pre-defined policy is defined as allowing or prohibit a function or library to perform any of the following actions:

code execution;

file access; and

network access.

10 . A computer program product retaining on a computer readable storage medium, program instructions, which instructions when executed by a processor, cause the processor to perform:

attaching to a software program that is executed in a first process, a first program, a second program and a third program, the software program is programmed in an interpreter-based language, the software program incorporates a software library, wherein the first program is attached to one or more entry points of functions of the software library, wherein the second program to one or more exit points of the functions of the software library, wherein the third program is attached to system call invocations by the software program, wherein at least one of the first program, the second program and the third program is implemented using an extended Berkeley Packet Filter (eBPF), the first program configured to issue indications of entries to functions, the second program configured to issue indications of exits from functions, the third program is configured to issue indications of system call invocations,

wherein a portion of the first program, the second program and the third program is implemented without using the eBPF, whereby the portion is used to collect information from user mode, whereby reducing overhead associated with mode switching from kernel mode to user mode or vice versa;

receiving, by a monitoring agent, the indications of entries and the indications of exits, the monitoring agent is executed in a second process, the second process having a separate processing space than the first process;

based on the indications of entries and exits, monitoring, by the monitoring agent, a stack trace of the software program, whereby tracking stack state in the separate processing space;

based on the indications of system call invocations and based on the stack trace of the software program, identifying, by the monitoring agent, system call invocations by the software library; and

performing responsive action in response to a determination that a system call invocation deviates from a pre-defined policy of authorized functionalities.

11 . A system comprising:

a host computer comprising a processor and a memory, a software program is retained on the memory, wherein the software program is programmed in an interpreter-based language, the software program incorporates a software library, the host computer is configured to execute an operating system having a kernel and provisioning distinct processing spaces to different executed programs;

wherein said processor is configured to:

attach a first program to one or more entry points of functions of the software library, a second program to one or more exit points of the functions of the software library and a third program to system call invocations by the software program, wherein at least one of the first program, the second program and the third program is implemented using an extended Berkeley Packet Filter (eBPF), whereby the eBPF providing observability in kernel mode of the operating system, the first program configured to issue indications of entries to functions, the second program configured to issue indications of exits from functions, the third program is configured to issue indications of system call invocations,

wherein a portion of the first program, the second program and the third program is implemented without using the eBPF, whereby the portion is used to collect information from user mode, whereby reducing overhead associated with mode switching from kernel mode to user mode or vice versa;

receive, by a monitoring agent, the indications of entries and the indications of exits, the monitoring agent is executed in a second process of the host computer, the second process having a separate processing space than the first process;

based on the indications of entries and the indications of exits, monitor, by the monitoring agent, a stack trace of the software program, whereby tracking stack state in the separate processing space;

based on the indications of system call invocations and based on the stack trace of the software program, identify, by the monitoring agent, system call invocations by the software library; and

perform responsive action in response to a determination that a system call invocation deviates from a pre-defined policy of authorized functionalities.

12 . The system of claim 11 , wherein the monitoring agent and the software program are programmed using different programming languages.

13 . The system of claim 11 , wherein the host computer is part of a container orchestration system, wherein the first process executing the software program is a first container of the container orchestration system, wherein the second process is a second container of the container orchestration system.

14 . The system of claim 13 , wherein the host computer executing one or more additional containers, the one or more additional containers are used to execute one or more additional programs, each of the one or more additional programs is attached at runtime with monitoring programs for monitoring entries and exists to functions thereof and to system call invocations therefrom, whereby enabling the monitoring agent to monitor, in a single processing space, a plurality of different stack traces, whereby reducing resource overhead utilized for monitoring stack traces.

15 . The system of claim 11 , wherein stable execution of the software program is not compromised in an event of unexpected termination of the monitoring agent, whereby robust execution of the software program is provided while enabling stack trace monitoring thereof.

16 . The system of claim 11 , wherein the responsive action comprises preventing the system call invocation, whereby enforcing the pre-defined policy.

17 . The system of claim 11 , wherein the responsive action providing a visual display to a user indicating identified security issues associated with a plurality of software libraries including the software library.

18 . The system of claim 11 , wherein the pre-defined policy is defined in a function-granularity or in a library-granularity.

19 . The system of claim 11 , wherein the pre-defined policy is defined as allowing or prohibit a function or library to perform any of the following actions:

code execution;

file access; and

network access.