System, method and computer program product for virtual patching
View Patent ↗A system, method, and computer program product are provided for virtual patching. Initially, information associated with at least one vulnerability of a computer application is collected. Further, at least one host interface is identified that is capable of being used to access the vulnerability. In use, data sent to the at least one host interface is analyzed to determine whether the data is unwanted, based on the information.
1. A method to be performed in conjunction with a processor configured for executing non-transitory instructions stored in a memory, the method comprising:
collecting information associated with at least one vulnerability of a computer application;
identifying at least one host interface that is capable of being used to access the vulnerability of the computer application;
analyzing data sent to the at least one host interface that was identified to determine whether the data is unwanted, wherein the identifying includes reproducing the vulnerability of the computer application, and determining a root cause of the vulnerability of the computer application, wherein a vector that is associated with the root cause is recorded, and wherein the vector is provided in a same form as an object in which the vulnerability is located; and
creating a detection algorithm, which is based on the root cause, to be used in detecting subsequent unwanted data instances.
2. The method of claim 1 , wherein the information is collected from a software patch.
3. The method of claim 1 , further comprising initiating an event if the data is determined to be unwanted.
4. The method of claim 3 , wherein the event includes preventing the data from accessing the at least one host interface that was identified.
5. The method of claim 3 , wherein the event includes creating a software exception.
6. The method of claim 3 wherein the event includes suspending a thread executing the data.
7. The method of claim 3 , wherein the event includes terminating execution of a process associated with the data.
8. The method of claim 1 , wherein the information includes public information.
9. The method of claim 1 , wherein the information is collected utilizing black box testing.
10. The method of claim 1 , wherein the information is collected utilizing binary differentiation.
11. The method of claim 1 , wherein the at least one host interface is identified utilizing a debugger.
12. The method of claim 1 , wherein the at least one host interface is identified utilizing a static analysis.
13. The method of claim 1 , wherein a closest host interface is identified and only data sent to the closest host interface is analyzed, when a plurality of the host interfaces is identified.
14. The method of claim 1 , wherein the collecting, identifying and analyzing are capable of being disabled.
15. The method of claim 1 , wherein the collecting includes:
filtering the information; and
classifying the information.
16. The method of claim 15 , wherein the filtering includes identifying at least one of a vulnerability name, a severity level, and an affected platform.
17. The method of claim 1 , wherein the at least one host interface includes a function that serves as an access point to the vulnerability of the computer application.
18. The method of claim 1 , further comprising intercepting all calls attempting to access the at least one host interface, and validating each call before allowing the call to proceed via the at least one host interface.
19. A computer program product embodied on a non-transitory computer readable medium for performing operations, the operations comprising:
collecting information associated with at least one vulnerability of a computer application;
identifying at least one host interface that is capable of being used to access the vulnerability of the computer application, utilizing a processor; and
analyzing data sent to the at least one host interface that was identified to determine whether the data is unwanted, wherein the identifying includes reproducing the vulnerability of the computer application, and determining a root cause of the vulnerability of the computer application, wherein a vector that is associated with the root cause is recorded, and wherein the vector is provided in a same form as an object in which the vulnerability is located; and
creating a detection algorithm, which is based on the root cause, to be used in detecting subsequent unwanted data instances.
20. A system, comprising:
a processor configured for executing non-transitory instructions stored in a memory, wherein the system is configured for:
collecting information associated with at least one vulnerability of a computer application;
identifying at least one host interface that is capable of being used to access the vulnerability of the computer application, wherein the system is operable such that data sent to the at least one host interface that was identified is analyzed to determine whether the data is unwanted, wherein the system is operable such that the identifying includes reproducing the vulnerability of the computer application, and determining a root cause of the vulnerability of the computer application, wherein a vector that is associated with the root cause is recorded, and wherein the vector is provided in a same form as an object in which the vulnerability is located; and
creating a detection algorithm, which is based on the root cause, to be used in detecting subsequent unwanted data instances.
21. A method to be performed in conjunction with a processor configured for executing non-transitory instructions stored in a memory, the method comprising:
collecting information associated with at least one vulnerability of a computer application, including filtering the information and classifying the information;
identifying at least one host interface that is capable of being used to access the vulnerability of the computer application, utilizing a processor, the vulnerability of the computer application being reproduced and a root cause analysis being performed to identify the at least one host interface, wherein a vector that is associated with the root cause is recorded, and wherein the vector is provided in a same form as an object in which the vulnerability is located;
analyzing data sent to the at least one host interface that was identified to determine whether the data is unwanted, based on the information; and
creating a detection algorithm, which is based on the root cause, to be used in detecting subsequent unwanted data instances.