Apparatus and Method for Monitoring Program Invariants to Identify Security Anomalies
A computer readable storage medium includes executable instructions to insert monitors at selected locations within a computer program. Training output from the monitors is recorded during a training phase of the computer program. Program invariants are derived from the training output. During a deployment phase of the computer program, deployment output from the monitors is compared to the program invariants to identify security anomalies.
1 . A computer readable storage medium, comprising executable instructions to:
insert monitors at selected locations within a computer program;
record training output from the monitors during a training phase of the computer program;
derive program invariants from the training output; and
compare, during a deployment phase of the computer program, deployment output from the monitors to the program invariants to identify security anomalies.
2 . The computer readable storage medium of claim 1 wherein the security anomalies include illegitimate attacks upon a computer program considered to be legitimate.
3 . The computer readable storage medium of claim 1 wherein the executable instructions to insert include executable instructions to insert monitors at computer program write locations.
4 . The computer readable storage medium of claim 3 wherein the executable instructions to insert include executable instructions to insert monitors at computer program HTTP write locations to prevent cross-site scripting.
5 . The computer readable storage medium of claim 1 wherein the executable instructions to insert include executable instructions to insert monitors at computer program query execution locations.
6 . The computer readable storage medium of claim 5 wherein the executable instructions to insert include executable instructions to insert monitors at computer program SQL query execution locations to prevent SQL injection attacks.
7 . The computer readable storage medium of claim 1 wherein the program invariants have associated program context.
8 . The computer readable storage medium of claim 1 further comprising executable instructions to supply a security response.
9 . The computer readable storage medium of claim 8 wherein the security response is an exception.
10 . The computer readable storage medium of claim 8 wherein the security response is a log entry.
11 . The computer readable storage medium of claim 8 wherein the security response is a displayed message.
12 . The computer readable storage medium of claim 8 wherein the security response is an alert to a system monitor.