Systems and methods for causing nonpredictable environment states for exploit prevention and malicious code neutralization for javascript-enabled applications

1. A cyber security system comprising:

at least one processor configured to:

receive, by an application capable of JavaScript execution, code for execution;

before execution of input code by a JavaScript-enabled application, run an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation of the input code;

intercept, by the intercepting code, an API invocation of the input code;

determine that the intercepted API invocation results in a manipulation of a backing store object; and

modify an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes at least one of padding input data associated with the API invocation; encoding input data associated with the API invocation;

manipulating input data associated with the API invocation;

splitting, into multiple execution contexts, input data associated with the API invocation; or changing object shape information; and

the modified execution results in a nonpredictable environment state.

2. The cyber security system of claim 1 , wherein the nonpredictable environment state includes at least one of a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

3. The cyber security system of claim 1 , wherein the intercepting code is configured to patch an exposed native API of a current execution context and intercept an API invocation of the patched native API.

4. The cyber security system of claim 1 , wherein native API functionality of at least one patched API is maintained within the nonpredictable environment state.

5. A cyber security system comprising:

at least one processor configured to:

receive, by an application capable of JavaScript execution, code for execution;

before execution of input code by a JavaScript-enabled application, run an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation of the input code;

intercept, by the intercepting code, an API invocation of the input code:

determine that the intercepted API invocation results in a manipulation of a backing store object; and

modify an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes at least one of: encoding in input data associated with the API invocation, at least some randomly selected arguments;

dividing into a random number of execution contexts, input data associated with the API invocation; splitting into a random number of subsets, input data associated with the API invocation; padding with random data of a same type as an argument, at least some randomly selected arguments in input data associated with the API invocation; adding a random number of inline properties to input data associated with the API invocation; allocating within memory a random number of additional backing store objects; or holding at least one object reference in memory in a manner preventing collection by a garbage collector, and releasing the at least one held object reference for garbage collection upon an occurrence of a specified condition, and

the modified execution results in a nonpredictable environment state.

6. The cyber security system of claim 5 , wherein the nonpredictable environment state includes at least one of a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

7. The cyber security system of claim 5 , wherein the intercepting code is configured to patch an exposed native API of a current execution context and intercept an API invocation of the patched native API.

8. The cyber security system of claim 5 , wherein native API functionality of at least one patched API is maintained within the nonpredictable environment state.

9. A computer-implemented method for cyber security, the method comprising:

receiving, by an application capable of JavaScript execution, code for execution;

before execution of input code by a JavaScript-enabled application, running an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation of the input code;

intercepting, by the intercepting code, an API invocation of the input code;

determining that the intercepted API invocation results in a manipulation of a backing store object; and

modifying an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes at least one of: padding input data associated with the API invocation; encoding input data associated with the API invocation; manipulating input data associated with the API invocation; splitting, into multiple execution contexts, input data associated with the API invocation; or changing object shape information, and

the modified execution results in a nonpredictable environment state.

10. The computer-implemented method of claim 9 , wherein the nonpredictable environment state includes at least one of a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

11. The computer-implemented method of claim 9 , wherein the intercepting code is configured to patch an exposed native API of a current execution context and intercept an API invocation of the patched native API.

12. The computer-implemented method of claim 9 , wherein native API functionality of at least one patched API is maintained within the nonpredictable environment state.

13. The computer-implemented method of claim 9 , wherein the API invocation is intercepted from at least one available execution context associated with the execution of the input code.

14. A computer-implemented method for cyber security, the method comprising:

receiving, by an application capable of JavaScript execution, code for execution;

before execution of input code by a JavaScript-enabled application, running an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation of the input code;

intercepting, by the intercepting code, an API invocation of the input code;

determining that the intercepted API invocation results in a manipulation of a backing store object; and

modifying an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes at least one of: encoding in input data associated with the API invocation, at least some randomly selected arguments; dividing into a random number of execution contexts, input data associated with the API invocation; splitting into a random number of subsets, input data associated with the API invocation; padding with random data of a same type as an argument, at least some randomly selected arguments in input data associated with the API invocation; adding a random number of inline properties to input data associated with the API invocation;

allocating within memory a random number of additional backing store objects; or holding at least one object reference in memory in a manner preventing collection by a garbage collector, and releasing the at least one held object reference for garbage collection upon an occurrence of a specified condition, and

the modified execution results in a nonpredictable environment state.

15. The computer-implemented method of claim 14 , wherein the nonpredictable environment state includes at least one of a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

16. The computer-implemented method of claim 14 , wherein the intercepting code is configured to patch an exposed native API of a current execution context and intercept an API invocation of the patched native API.

17. The computer-implemented method of claim 14 , wherein native API functionality of at least one patched API is maintained within the nonpredictable environment state.

18. The computer-implemented method of claim 14 , wherein the API invocation is intercepted from at least one available execution context associated with the execution of the input code.

19. A non-transitory computer-readable medium storing program instructions executable by at least one processor to:

receive, by an application capable of JavaScript execution, code for execution;

before execution of input code by a JavaScript-enabled application, run an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation of the input code;

intercept, by the intercepting code, an API invocation of the input code;

determine that the intercepted API invocation results in a manipulation of a backing store object; and

modify an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes at least one of: padding input data associated with the API invocation; encoding input data associated with the API invocation; manipulating input data associated with the API invocation; splitting, into multiple execution contexts, input data associated with the API invocation; or changing object shape information, and

the modified execution results in a nonpredictable environment state.

20. The non-transitory computer-readable medium of claim 19 , wherein the nonpredictable environment state includes at least one of a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

21. The non-transitory computer-readable medium of claim 19 , wherein the intercepting code is configured to patch an exposed native API of a current execution context and intercept an API invocation of the patched native API.

22. The non-transitory computer-readable medium of claim 19 , wherein native API functionality of at least one patched API is maintained within the nonpredictable environment state.

23. The non-transitory computer-readable medium of claim 19 , wherein the API invocation is intercepted from at least one available execution context associated with the execution of the input code.

24. A non-transitory computer-readable medium storing program instructions executable by at least one processor to:

receive, by an application capable of JavaScript execution, code for execution;

before execution of input code by a JavaScript-enabled application, run an intercepting code, wherein the intercepting code is configured to intercept at least one application programming interface (API) invocation of the input code;

intercept, by the intercepting code, an API invocation of the input code;

determine that the intercepted API invocation results in a manipulation of a backing store object; and

modify an execution of the intercepted API invocation, wherein:

modifying the execution of the intercepted API invocation includes at least one of: encoding in input data associated with the API invocation, at least some randomly selected arguments; dividing into a random number of execution contexts, input data associated with the API invocation; splitting into a random number of subsets, input data associated with the API invocation; padding with random data of a same type as an argument, at least some randomly selected arguments in input data associated with the API invocation; adding a random number of inline properties to input data associated with the API invocation; allocating within memory a random number of additional backing store objects; or holding at least one object reference in memory in a manner preventing collection by a garbage collector, and releasing the at least one held object reference for garbage collection upon an occurrence of a specified condition; and

the modified execution results in a nonpredictable environment state.

25. The non-transitory computer-readable medium of claim 24 , wherein the nonpredictable environment state includes at least one of a non-predictable memory layout, a non-predictable memory behavior, or a non-predictable property of an object.

26. The non-transitory computer-readable medium of claim 24 , wherein the intercepting code is configured to patch an exposed native API of a current execution context and intercept an API invocation of the patched native API.

27. The non-transitory computer-readable medium of claim 24 , wherein native API functionality of at least one patched API is maintained within the nonpredictable environment state.

28. The non-transitory computer-readable medium of claim 24 , wherein the API invocation is intercepted from at least one available execution context associated with the execution of the input code.