Deterministic method for detecting and blocking of exploits on interpreted code

1. A method useful for preventing exploitation of a vulnerability in an interpreted code by monitoring and validating an execution of the interpreted code in a script file by an application server, comprising:

generating a mapping for an incoming network connection to a specified script file to be executed by an application server;

inserting a hook for monitoring an application programming interface (API) call or a privileged instruction executed by the application server;

inserting a validation code configured to validate the API call or the privileged instruction executed by the interpreted code in a script, wherein the validation code matches the API call or the privileged instruction against a rule set for the script;

loading the rule set, wherein the rule set specifies a type of API call or a type of privileged instruction, and wherein the rule set specified a location of the API call or the privileged instruction in the interpreted code;

capturing an event, wherein the event indicates a start and an end of an execution of the interpreted code, wherein an application server thread manages the event;

obtaining an execution event of the API call or the privileged instruction that correspond to a specific script files by filtering the event collected from the application server;

checking, with a validation code, a conformity of the execution event of the API call or the privileged instruction with the rule set for the script as determined by the mapping;

detecting a rule violation; and

obtaining, with the validation code, a default action for the execution event of the API call or the privileged instruction during the execution of the interpreted code.

2. The method of claim 1 , wherein the interpreted code comprises a script executed by a web application server.

3. The method of claim 2 , wherein an observed API call or an observed privileged instruction is reported to a rule server and a corresponding rule is received from the rule server.

4. The method of claim 3 , wherein the observed API call or the observed privileged instruction location is validated against a known structure of the interpreted code.

5. The method of claim 4 , wherein the observed API call location is validated by verifying an argument used during an analysis of a bytecode structure of the interpreted code.

6. The method of claim 5 , wherein a rule list is downloaded from a rule server and used for validating the API call or the privileged instruction as executed by the interpreted code.

7. The method of claim 6 , wherein a dynamic analysis is performed to determine the API call or the privileged instruction executed by the interpreted code, and wherein the dynamic analysis is used to create a rule.

8. The method of claim 7 , wherein the validation code executes at a remote server location.

9. The method of claim 8 , wherein an additional information about the system state is reported to the rule server.