System and method for securing applications through an application-aware runtime agent
A system and method for securing an application through an application-aware runtime agent can include: acquiring a code profile, instrumenting the application with a runtime agent according to the code profile, enforcing the runtime agent on the execution of the application, and responding to the runtime agent. Enforcing the runtime agent on the execution of the application can include monitoring the execution flow, which comprises of monitoring the utilization of the controls through the execution of the application; detecting a threat, which comprises identifying a section of the execution flow as a potential security threat; and regulating the execution flow to prevent or ameliorate the security threat. Responding to the runtime agent can include responding to the security threat and providing a user interface that may output runtime agent diagnostics and trigger alerts.
1. A method for securing an application comprising:
converting a set of code sources of the application to a code profile, which comprises a set of flow graphs and which characterizes controls within the set of code sources;
mapping controls of interest within the code profile by identifying sequences of controls in the set of flow graphs that are associated with detection of a potential security event;
instrumenting the application according to the code profile, wherein instrumenting comprises augmenting the execution of the controls of interest in the application to trigger tracking operations during execution of the application;
during execution of the application, tracking execution flow of the controls of interest through triggered tracking operations, and detecting a security event based at least in part on a detected sequence of execution flow associated with the security event.
2. The method of claim 1 , wherein the controls of interest comprise method calls, datatype activity calls, user defined vulnerabilities, and input and output calls.
3. The method of claim 1 , further comprising, during the execution of the application, monitoring data input.
4. The method of claim 1 , further comprising responding to the security event, which comprises segmenting and classifying a data payload of the execution flow.
5. The method of claim 1 , wherein tracking execution flow of the controls of interest is language agnostic, thereby executable in multiple programming languages.
6. The method of claim 1 , wherein detecting the security event further comprises looking up a section of the execution flow in a security profile dictionary; and responding to the security event further by updating the security profile dictionary.
7. The method of claim 1 , further comprising responding to the security event, which comprises regulating the execution flow and preventing sequential utilization of controls associated with the security event.
8. The method of claim 1 , further comprising responding to the security event, which comprises identifying involved controls within the set of code sources and reporting the involved controls through a user interface.
9. The method of claim 1 , further comprising responding to the security event, which comprises showing portions of the set of code sources that led to detecting the security event.
10. The method of claim 1 , further comprising responding to the security event, which comprises blocking execution flow associated with the security event.
11. The method of claim 1 , further comprising responding to the security event, which comprises modifying firewall settings based on clients involved in the security event.
12. The method of claim 1 , further comprising responding to the security event, which comprises generating a security event notification.
13. The method of claim 1 , wherein detecting the security event comprises identifying a section of the execution flow defined within a security profile dictionary; and responding to the security event by selectively performing at least one of the following:
locating the application controls and external inputs that led to detecting the security event,
preventing sequential utilization of controls associated with the security event,
sending an alert regarding the security event, and
providing a user interface that outputs runtime agent diagnostics and security event alerts and enables user control of the runtime agent.
14. The method of claim 1 , wherein augmenting the execution of the controls of interest in the application to trigger tracking operations further comprises augmenting execution of controls of interest to increment a counter conditional on the execution flow between controls of interest, wherein the counter increments differently depending on if the execution flow satisfies a sequence condition associated with a security event.
15. The method of claim 14 , wherein augmenting the execution of the controls of interest in the application comprises inserting atomic compare and swap instructions at the controls of interest to conditionally increment the counter based on sequence of execution path through instrumented controls.
16. The method of claim 14 , wherein augmenting the execution of the controls of interest in the application comprises inserting jump statements into method calls of the controls of interest, wherein the jump statements conditionally increment the counter based on sequence of execution path through instrumented controls.
17. The method of claim 1 , wherein augmenting the execution of the controls of interest in the application comprises compiling the set of source codes to add the tracking operations to controls of interest.
18. The method of claim 1 , wherein detecting the security event is further based upon, if a sequence of execution flow is associated with a security event, analyzing data payload and detecting the security event based on payload analysis.