Method and system of hardening applications against security attacks
View Patent ↗In one aspect, computerized method for hardening security of an application includes the step of modifying a set of instructions of an application to include at least one sensor adapted to capture a set of information snapshots from within the application in a running state. The method includes the step of analyzing, from within the application, the set of information snapshots from the at least one sensor. The method includes the step of detecting a presence, a status, and a configuration of a security defense mechanism based on an analysis of the information snapshots; invoking an appropriate hardening action to improve the security defense mechanism of the application.
1. A computerized method for hardening security of an application comprising:
modifying a set of instructions of an application to include at least one sensor adapted to capture a set of information snapshots from within the application when executed by one or more processors, in a running state;
capturing the set of information snapshots from within the application wherein the set of information snapshots comprises whether a set of defenses are enabled in the application and how said defenses are configured;
based on the set of information snapshots and from within the application and while the application is running, automatically generating a security rule of a security defense mechanism to be enforced by an external component by:
analyzing the set of information snapshots from the at least one sensor,
detecting a presence, a status, and a configuration of security defense mechanism based on an analysis of the information snapshots of each of the at least one vulnerability is a pattern of application execution that is subject to abuse by a user of the application when the application is being executed by the same one or more processors,
invoking an appropriate hardening action to improve the security defense mechanism of the application, wherein a set of hardening rules that control the hardening action are specified in an external configuration and related to the analysis of the information snapshots,
wherein the step of invoking the appropriate hardening action to improve the security defenses of the application further comprises:
modifying a specified portion of code of the application for at least one method in the application;
invoking at least one method to change a state or a configuration of the application;
replacing the specified portion of code for at least one method in the application; and
modifying an application file or another data store associated with the application to link a new security defense code into the application;
wherein the security defense mechanism comprises an authentication and forgery check, an authorization check, an input validation, an output escaping or encoding process, a data encryption, a logging process, a HTTP mechanism, a connection security process, a fraud prevention process, an integrity check, or a security filter; and
automatically pushing the security rule to an external component; and
enforcing the hardening action with the external component by automatically generating a security rule to be enforced by the external component, and automatically pushing the security rule to the external component, and wherein the external component comprises an operating system, web server, application server, network switch, network router, network firewall, or web application firewall.
2. The method of claim 1 , wherein the application hardening is combined with an application vulnerability detection process or an application attack detection and prevention process.
3. The method of claim 1 , wherein the application comprises a web application, a web service, an application programming interface (API), a mobile application, a client application, a server application, or an embedded application.
4. The method of claim 1 , wherein the application comprises a set of components comprising at least one of a runtime platform, a virtual machine, a set of application servers, an application framework, an application library, or an application module.
5. The method of claim 1 , wherein the set of information snapshots comprises information from a presence of a set of security defenses, the application library, the application framework, a software-architecture detail, an application state, a backend connection, or an application configuration information.
6. The method of claim 1 , wherein the hardening action comprises an addition of a missing defense, a defense enhancement, an enabling of a defense, a modification of a defense configuration, or an addition of an invocation of the defense in a specified location of a set of code of the application.
7. The method of claim 1 ,
wherein the security defense mechanism is centralized in the application module,
wherein the security defense mechanism distributed across the application code.
8. The method of claim 1 , wherein the security defense mechanism is located in the application platform, the application server, the application framework, the application library, the application module, the set of components used by the application, or a custom code segment of the application.
9. The method of claim 6 , wherein the hardening action is defined by the user.
10. The method of claim 9 , wherein the step of modifying the set of instructions of the application to include at least one sensor adapted to capture the set of information snapshots from within the application in a running state further comprises the step of:
dynamically patching the code segment at a run-time of the application.
11. The method of claim 10 , wherein the code segment to be patched comprise a software component of the application or the application library.
12. The method of claim 1 wherein the at least one sensor comprises passive sensors, active sensors, or response sensors.
13. A computerized system useful for hardening security of an application comprising:
a computer store containing data, wherein the data comprises:
one or more hardening rules;
a computer processor in the computerized system, wherein the computer processor is configured to perform the steps of:
modify a set of instructions of an application to include at least one passive sensor adapted to capture a set of information snapshots from within the application when executed by one or more processors in a running state;
capture, with the passive sensor, the set of information snapshots from within the application, wherein the set of information snapshots comprises whether a set of defenses are enabled in the application and how said defenses area configured;
based on the set of information snapshots and form within the application and while the application is running, automatically generating a security rule of a security defense mechanism to be enforced by an external component:
analyze, from within the application and while the application is running, the set of information snapshots from the at least one passive sensor,
detect a presence, a status, and a configuration of the security defense mechanism based on an analysis of the information snapshots each of the at least one vulnerability is a pattern of application execution that is subject to abuse by a user of the application when the application is being executed by the same one or more processors, and
invoke an appropriate hardening action to improve the security defense mechanism of the application, wherein a set of hardening rules that control the hardening action are specified in an external configuration and related to the analysis of the information snapshots,
wherein the step of invoking the appropriate hardening action to improve the security defenses of the application further comprises:
modifying a specified portion of code of the application for at least one method in the application;
invoking at least one method to change a state or a configuration of the application;
replacing the specified portion of code for at least one method in the application; and
modifying an application file or another data store associated with the application to link a new security defense code into the application;
wherein the security defense mechanism comprises an authentication and forgery check, an authorization check, an input validation, an output escaping or encoding process, a data encryption, a logging process, a HTTP mechanism, a connection security process, a fraud prevention process, an integrity check, or a security filter;
automatically causing the security rule to be pushed to an external component; and
enforce the hardening action with the external component, and wherein the external component comprises an operating system, web server, application server, network switch, network router, network firewall, or web application.
14. The computerized system of claim 13 , wherein the application hardening is combined with an application vulnerability detection process or an application attack detection and prevention process.
15. The method of claim 14 , wherein the application comprises a web application, a web service, application programming interface (API), a mobile application, a client application, a server application, or an embedded application.
16. The method of claim 15 , wherein the application comprises a set of components comprising at least one of a runtime platform, a virtual machine, a set of application servers, an application framework, an application library, or an application module.