Automatic curation and modification of virtualized computer programs

1. A computer-implemented method comprising:

receiving computer program data at a security unit having one or more processors;

implementing one or more security-related modifications to the computer program data, resulting in creating modified computer program data;

executing the modified computer program data in a monitored environment;

analyzing output from the modified computer program data and identifying one or more variances from an expected output;

performing a responsive action selected from one or more of: disabling one or more security protections that have been implemented in the modified computer program data; reducing or increasing the stringency of one or more security protections that have been implemented in the modified computer program data; updating the security unit based on the variances;

further comprising:

receiving a just-in-time compiled application program;

executing the just-in-time compiled application program in a monitored execution environment;

observing and recording identification information for each of a plurality of function jumps to or from the just-in-time compiled application program;

generating one or more instructions, describing security protections to implement for the identification information for the plurality of function jumps, and sending the instructions to one or more security enforcement endpoints over a computer network;

wherein the method is performed using one or more processor and;

wherein the reducing or increasing is performed based on the reputation data.

2. The method of claim 1 , further comprising generating one or more instructions, describing security protections to implement for the computer program data, and sending the instructions to one or more security enforcement endpoints over a computer network.

3. The method of claim 1 , wherein the computer program data comprises any of: an application program executable; application program configuration data; one or more units of an operating system.

4. The method of claim 1 , wherein the analyzing comprises performing one or more tests on the modified computer program data, and wherein the number, length or intensity of the tests varies based on policy data relating to factors such as ubiquity or importance of the computer program data.

5. The method of claim 1 , further comprising receiving reputation data associated with a security reputation of the computer program data, and wherein the responsive action is selected based on the reputation data.

6. The method of claim 1 , further comprising receiving reputation data associated with a security reputation of the computer program data, and wherein the reducing or increasing is performed based on the reputation data.

7. The method of claim 1 , wherein the steps of receiving computer program data, implementation one or more security-related modifications, executing the modified computer program data, analyzing output and performing a responsive action, are performed in response to the security unit detecting a newer version of the computer program data is available.

8. The method of claim 1 , wherein the steps of implementation one or more security-related modifications, executing the modified computer program data, analyzing output and performing a responsive action, are performed in response to one or more changes to the security unit.

9. A computer-implemented method comprising:

receiving computer program data at a security unit having one or more processors;

executing the computer program data in a monitored environment;

allowing the computer program data to make one or more modifications to the computer program data or to the monitored environment;

analyzing the one or more modifications and identifying one or more variances from an expected operation of the computer program data;

updating the security unit based on the variances;

further comprising:

receiving a just-in-time compiled application program;

executing the just-in-time compiled application program in a monitored execution environment;

observing and recording identification information for each of a plurality of function jumps to or from the just-in-time compiled application program;

generating one or more instructions, describing security protections to implement for the identification information for the plurality of function jumps, and sending the instructions to one or more security enforcement endpoints over a computer network;

wherein the method is performed using one or more processors.

10. The method of claim 9 , wherein analyzing the one or more modifications further comprises:

analyzing an executing binary translation of the computer program data;

identifying one or more values from the executing binary translation;

in response to validating a specific value from the one or more values as a memory location that represents a pointer, creating a record associated with the binary translation that indicates the memory location is a valid pointer.

11. A non-transitory computer readable storage medium storing one or more sequences of instructions which when executed by one or more processors cause performing:

receiving computer program data at a security unit;

implementing one or more security-related modifications to the computer program data, resulting in creating modified computer program data;

executing the modified computer program data in a monitored environment;

analyzing output from the modified computer program data and identifying one or more variances from an expected output;

performing a responsive action selected from one or more of: disabling one or more security protections that have been implemented in the modified computer program data; reducing or increasing the stringency of one or more security protections that have been implemented in the modified computer program data;

updating the security unit based on the variances;

further comprising sequences of instructions which when executed by the one or more processor cause performing:

receiving a just-in-time compiled application program;

executing the just-in-time compiled application program in a monitored execution environment;

observing and recording identification information for each of a plurality of function jumps to or from the just-in-time compiled application program;

generating one or more instructions, describing security protections to implement for the identification information for the plurality of function jumps, and sending the instructions to one or more security enforcement endpoints over a computer network.

12. The computer readable medium of claim 11 , further comprising instructions which when executed cause generating one or more instructions, describing security protections to implement for the computer program data, and sending the instructions to one or more security enforcement endpoints over a computer network.

13. The computer readable medium of claim 11 , wherein the computer program data comprises any of: an application program executable; application program configuration data; one or more units of an operating system.

14. The computer readable medium of claim 11 , wherein the instructions which when executed cause analyzing comprise instructions which when executed cause performing one or more tests on the modified computer program data, and wherein the number, length or intensity of the tests varies based on policy data relating to factors such as ubiquity or importance of the computer program data.

15. The computer readable medium of claim 11 , further comprising instructions which when executed cause receiving reputation data associated with a security reputation of the computer program data, and wherein the responsive action is selected based on the reputation data.

16. The computer readable medium of claim 11 , further comprising instructions which when executed cause receiving reputation data associated with a security reputation of the computer program data, and wherein the reducing or increasing is performed based on the reputation data.

17. The computer readable medium of claim 11 , wherein instructions which when executed cause receiving computer program data, implementation one or more security-related modifications, executing the modified computer program data, analyzing output and performing a responsive action, are executed in response to the security unit detecting a newer version of the computer program data is available.

18. The computer readable medium of claim 11 , wherein the instructions which when executed cause implementation one or more security-related modifications, executing the modified computer program data, analyzing output and performing a responsive action, are executed in response to one or more changes to the security unit.

19. A non-transitory computer readable storage medium storing one or more sequences of instructions which when executed cause performing:

receiving computer program data at a security unit;

executing the computer program data in a monitored environment;

allowing the computer program data to make one or more modifications to the computer program data or to the monitored environment;

analyzing the one or more modifications and identifying one or more variances from an expected operation of the computer program data;

updating the security unit based on the variances;

further comprising sequences of instructions which when executed by the one or more processors cause performing:

receiving a just-in-time compiled application program;

executing the just-in-time compiled application program in a monitored execution environment;

observing and recording identification information for each of a plurality of function jumps to or from the just-in-time compiled application program;

generating one or more instructions, describing security protections to implement for the identification information for the plurality of function jumps, and sending the instructions to one or more security enforcement endpoints over a computer network.

20. The computer readable medium of claim 19 , wherein the instructions which when executed cause analyzing the one or more modifications further comprise instructions which when executed cause:

analyzing an executing binary translation of the computer program data;

identifying one or more values from the executing binary translation;

in response to validating a specific value from the one or more values as a memory location that represents a pointer, creating a record associated with the binary translation that indicates the memory location is a valid pointer.

21. A security unit comprising:

one or more processors;

a non-transitory computer-readable storage medium storing one or more sequences of instructions which, when executed by the one or more processors, cause the one or more processors to perform:

receiving computer program data at the security unit;

implementing one or more security-related modifications to the computer program data, resulting in creating modified computer program data;

executing the modified computer program data in a monitored environment;

analyzing output from the modified computer program data and identifying one or more variances from an expected output;

performing a responsive action selected from one or more of: disabling one or more security protections that have been implemented in the modified computer program data; reducing or increasing the stringency of one or more security protections that have been implemented in the modified computer program data; updating the security unit based on the variances;

further comprising sequences of instructions which when executed by the one or more processors cause performing:

receiving a just-in-time compiled application program;

executing the just-in-time compiled application program in a monitored execution environment;

observing and recording identification information for each of a plurality of function jumps to or from the just-in-time compiled application program;

generating one or more instructions, describing security protections to implement for the identification information for the plurality of function jumps, and sending the instructions to one or more security enforcement endpoints over a computer network.

22. A security unit comprising:

one or more processors;

a computer-readable data storage medium storing one or more sequences of instructions which, when executed by the one or more processors, cause the one or more processors to perform:

receiving computer program data at the security unit;

executing the computer program data in a monitored environment;

allowing the computer program data to make one or more modifications to the computer program data or to the monitored environment;

analyzing the one or more modifications and identifying one or more variances from an expected operation of the computer program data;

updating the security unit based on the variances;

further comprising sequences of instructions which when executed by the one or more processors cause performing:

receiving a just-in-time compiled application program;

executing the just-in-time compiled application program in a monitored execution environment;

observing and recording identification information for each of a plurality of function jumps to or from the just-in-time compiled application program;

generating one or more instructions, describing security protections to implement for the identification information for the plurality of function jumps, and sending the instructions to one or more security enforcement endpoints over a computer network.