IP Library › Granted Patent US 11,507,658

Granted Patent B2

US 11,507,658 · App. 17/575,139 · Granted Nov 22, 2022

Systems and methods for exploit prevention and malicious code neutralization using non-predictable results for JavaScript-enabled applications

Inventor: Avihay Cohen (Tel-Aviv, IL)

Assignee: Seraphic Algorithms Ltd.

G06F21/554 G06F21/128 G06F21/54 G06F9/45529 G06F9/54 G06F2221/033

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 11,507,658
App. No.: 17/575,139
Granted: Nov 22, 2022
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

Systems, methods, and computer-readable media for cybersecurity are disclosed. The systems and methods may involve receiving, by an application capable of JavaScript execution, code for execution; executing, before execution of the received code, an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation by the received code; intercepting, by the intercepting code, an API invocation by the received code; determining that the intercepted API invocation results in a manipulation of a backing store object; and modifying an execution of the intercepted API invocation, wherein the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

Claims (213)

1. A cyber security system comprising:

at least one processor configured to:

receive, by an application capable of JavaScript execution, code for execution;

before execution of input code by a JavaScript-enabled application, run an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation of the input code;

intercept, by the intercepting code, an API invocation of the input code, wherein intercepting the API invocation includes creating a new JavaScript object;

determine that the intercepted API invocation results in a manipulation of a backing store object; and

modify an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes dividing input data associated with the API invocation into a random number of execution contexts by splitting the input data into a random number of subsets, and creating, for the subsets, separate objects within at least one of the execution contexts, and

the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

2. The cyber security system of claim 1 , wherein modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

padding with random data of a same type as the argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

holding at least one object reference in memory in a manner preventing collection by a garbage collector, and releasing the at least one held object reference for garbage collection upon an occurrence of a specified condition.

3. A cyber security system comprising:

at least one processor configured to:

receive, by an application capable of JavaScript execution, code for execution;

intercept, by the intercepting code, an API invocation of the input code, wherein intercepting the API invocation includes creating a new array object;

determine that the intercepted API invocation results in a manipulation of a backing store object; and

modify an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes dividing input data associated with the API invocation into a random number of execution contexts, the input data including arguments associated with the new array object, and the dividing including splitting the input data into a random number of subsets, and creating, for the subsets, separate array objects within at least one of the execution contexts, and

the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

4. The cyber security system of claim 3 , wherein modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

padding with random data of a same type as the argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

5. A cyber security system comprising:

at least one processor configured to:

receive, by an application capable of JavaScript execution, code for execution;

intercept, by the intercepting code, an API invocation of the input code;

determine that the intercepted API invocation results in a manipulation of a backing store object; and

modify an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes dividing input data associated with the API invocation into a random number of execution contexts, the input data having at least one argument, and wherein the at least one processor is further configured to store a mapping of the modified execution, the mapping including a location, within the execution contexts, of the at least one argument, and

the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

6. The cyber security system of claim 5 , wherein modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

splitting into a random number of subsets, input data associated with the API invocation;

padding with random data of a same type as the argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

7. A cyber security system comprising:

at least one processor configured to:

receive, by an application capable of JavaScript execution, code for execution;

intercept, by the intercepting code, an API invocation of the input code;

determine that the intercepted API invocation results in a manipulation of a backing store object;

modify an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes dividing input data associated with the API invocation into a random number of execution contexts, the input data having at least one argument, and wherein the at least one processor is further configured to store a mapping of the modified execution, the mapping including a location, within the execution contexts, of the at least one argument, and

the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object; and

use the mapping to respond to at least one of a read operation by the intercepted API invocation or a write operation by the intercepted API invocation.

8. The cyber security system of claim 7 , wherein modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

splitting into a random number of subsets, input data associated with the API invocation;

padding with random data of a same type as the argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

9. A computer-implemented method for cyber security, the method comprising:

receiving, by an application capable of JavaScript execution, code for execution;

before execution of input code by a JavaScript-enabled application, running an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation of the input code;

intercepting, by the intercepting code, an API invocation of the input code, wherein intercepting the API invocation includes creating a new JavaScript object;

determining that the intercepted API invocation results in a manipulation of a backing store object; and

modifying an execution of the intercepted API invocation, wherein:

the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

10. The computer-implemented method of claim 9 , wherein modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

padding with random data of a same type as the argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

11. A computer-implemented method for cyber security, the method comprising:

receiving, by an application capable of JavaScript execution, code for execution;

intercepting, by the intercepting code, an API invocation of the input code, wherein intercepting the API invocation includes creating a new array object;

determining that the intercepted API invocation results in a manipulation of a backing store object; and

modifying an execution of the intercepted API invocation, wherein:

the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

12. The computer-implemented method of claim 11 , wherein modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

padding with random data of a same type as the argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

13. A computer-implemented method for cyber security, the method comprising:

receiving, by an application capable of JavaScript execution, code for execution;

intercepting, by the intercepting code, an API invocation of the input code;

determining that the intercepted API invocation results in a manipulation of a backing store object; and

modifying an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes dividing input data associated with the API invocation into a random number of execution contexts, the input data having at least one argument, and wherein the method further comprises storing a mapping of the modified execution, the mapping including a location, within the execution contexts, of the at least one argument, and

the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

14. The computer-implemented method of claim 13 , wherein modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

splitting into a random number of subsets, input data associated with the API invocation;

padding with random data of a same type as the argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

15. A computer-implemented method for cyber security, the method comprising:

receiving, by an application capable of JavaScript execution, code for execution;

intercepting, by the intercepting code, an API invocation of the input code;

determining that the intercepted API invocation results in a manipulation of a backing store object;

modifying an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes dividing input data associated with the API invocation into a random number of execution contexts, the input data having at least one argument, and wherein the method further comprises storing a mapping of the modified execution, the mapping including a location, within the execution contexts, of the at least one argument, and

the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object; and

using the mapping to respond to at least one of a read operation by the intercepted API invocation or a write operation by the intercepted API invocation.

16. The computer-implemented method of claim 15 , wherein modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

splitting into a random number of subsets, input data associated with the API invocation;

padding with random data of a same type as the argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

17. A computer-implemented method for cyber security, the method comprising:

receiving, by an application capable of JavaScript execution, code for execution;

intercepting, by the intercepting code, an API invocation of the input code;

determining that the intercepted API invocation results in a manipulation of a backing store object;

modifying an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes dividing input data associated with the API invocation into a random number of execution contexts, the input data having at least one argument, and wherein the method further comprises storing a mapping of the modified execution, the mapping including a location, within the execution contexts, of the at least one argument, and

modifying an execution of the intercepted API invocation, wherein the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object; and

using the mapping to respond to at least one of a read operation by the intercepted API invocation or a write operation by the intercepted API invocation, wherein using the mapping to respond includes using a proxy object.

18. The computer-implemented method of claim 17 , wherein modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

splitting into a random number of subsets, input data associated with the API invocation;

padding with random data of a same type as the argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

19. A non-transitory computer-readable medium storing program instructions executable by at least one processor to:

receive, by an application capable of JavaScript execution, code for execution;

intercept, by the intercepting code, an API invocation of the input code, wherein intercepting the API invocation includes creating a new JavaScript object;

determine that the intercepted API invocation results in a manipulation of a backing store object; and

modify an execution of the intercepted API invocation, wherein:

the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

20. The non-transitory computer-readable medium of claim 19 , wherein modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

padding with random data of a same type as the argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

21. A non-transitory computer-readable medium storing program instructions executable by at least one processor to:

receive, by an application capable of JavaScript execution, code for execution;

intercept, by the intercepting code, an API invocation of the input code, wherein intercepting the API invocation includes creating a new array object;

determine that the intercepted API invocation results in a manipulation of a backing store object; and

modify an execution of the intercepted API invocation, wherein:

the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

22. The non-transitory computer-readable medium of claim 21 , wherein modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

padding with random data of a same type as the argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

23. A non-transitory computer-readable medium storing program instructions executable by at least one processor to:

receive, by an application capable of JavaScript execution, code for execution;

intercept, by the intercepting code, an API invocation of the input code;

determine that the intercepted API invocation results in a manipulation of a backing store object; and

modify an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes dividing input data associated with the API invocation into a random number of execution contexts, the input data having at least one argument, and wherein the program instructions are further executable by the at least one processor to store a mapping of the modified execution, the mapping including a location, within the execution contexts, of the at least one argument, and

the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

24. The non-transitory computer-readable medium of claim 23 , wherein modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

splitting into a random number of subsets, input data associated with the API invocation;

padding with random data of a same type as the argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

25. A non-transitory computer-readable medium storing program instructions executable by at least one processor to:

receive, by an application capable of JavaScript execution, code for execution;

intercept, by the intercepting code, an API invocation of the input code;

determine that the intercepted API invocation results in a manipulation of a backing store object;

modify an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes dividing input data associated with the API invocation into a random number of execution contexts, the input data having at least one argument, and wherein the program instructions are further executable by the at least one processor to store a mapping of the modified execution, the mapping including a location, within the execution contexts, of the at least one argument, and

the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object; and

use the mapping to respond to at least one of a read operation by the intercepted API invocation or a write operation by the intercepted API invocation.

26. The non-transitory computer-readable medium of claim 25 , wherein modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

splitting into a random number of subsets, input data associated with the API invocation;

padding with random data of a same type as the argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

27. A non-transitory computer-readable medium storing program instructions executable by at least one processor to:

receive, by an application capable of JavaScript execution, code for execution;

intercept, by the intercepting code, an API invocation of the input code;

determine that the intercepted API invocation results in a manipulation of a backing store object;

modify an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes dividing input data associated with the API invocation into a random number of execution contexts, the input data having at least one argument, and wherein the program instructions are further executable by the at least one processor to store a mapping of the modified execution, the mapping including a location, within the execution contexts, of the at least one argument, and

the modified execution results in at least one of: a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object; and

use the mapping to respond to at least one of a read operation by the intercepted API invocation or a write operation by the intercepted API invocation, wherein using the mapping to respond includes using a proxy object.

28. The non-transitory computer-readable medium of claim 27 , wherein modifying the execution of the intercepted API invocation includes at least one of:

encoding in input data associated with the API invocation, at least some randomly selected arguments;

splitting into a random number of subsets, input data associated with the API invocation;

padding with random data of a same type as the argument, at least some randomly selected arguments in input data associated with the API invocation;

adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or

Assignments (3)

RELEASE OF SECURITY INTEREST Recorded Jun 25, 2026

From: HSBC BANK PLC

To: SERAPHIC ALGORITHMS LTD

Reel/Frame 075079/0275 →

SECURITY INTEREST Recorded May 12, 2025

From: SERAPHIC ALGORITHMS LTD

To: HSBC BANK PLC

Reel/Frame 071088/0637 →

ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jan 13, 2022

From: COHEN, AVIHAY

To: SERAPHIC ALGORITHMS LTD.

Reel/Frame 058648/0703 →

Continuity (3)

Continuation PCTIL2021051062 · Aug 31, 2021

Provisional Application 63072581 · Aug 31, 2020

Related Publication 20220164436A1 · May 26, 2022