Systems and methods of application layer security

1. A computer-implemented method of securing vulnerabilities in a program, the method comprising:

receiving, by a computer, state information generated by an application program;

training, by the computer, a constraints model based on the state information during execution of the application program;

generating, by the computer, one or more constraints with the constraints model based on a difference between the state information and expected state information, the constraints model configured to output the expected state information, each of the one or more constraints containing an execution constraint having a machine-readable instruction that prevents the application program from instructing the machine to deviate from a normal operation; and

applying, by the computer, the one or more constraints to the application program.

2. The computer-implemented method of claim 1 , wherein applying the one or more constraints to the application program includes generating executable code for a processing device running the application program and transmitting the executable code to the processing device.

3. The computer-implemented method of claim 1 , wherein the state information results from business logic of the application program.

4. The computer-implemented method of claim 3 , wherein the state information comprises internal variables of the application program.

5. The computer-implemented method of claim 1 , wherein the computer trains the constraints model with normal state information from the executed application program under normal operation.

6. The computer-implemented method of claim 1 , wherein the one or more constraints address security vulnerabilities in a business logic of an application layer of the application program.

7. The computer-implemented method of claim 1 , wherein the one or more constraints include at least one of an allowable range for an internal variable, an allowable state transition sequence, or an expected state dependent internal variable value.

8. A system for determining security vulnerabilities associated with an application program, the system comprising:

a non-transitory computer-readable storage medium having instructions stored thereon; and

a processor configured to execute the instructions to:

receive state information generated by an application program;

train a constraints model based on the state information during execution of the application program; and

generate one or more constraints with the constraints model based on a difference between the state information and expected state information, the constraints model configured to output the expected state information, each of the one or more constraints containing an execution constraint having a machine-readable instruction that prevents the application program from instructing the machine to deviate from a normal operation.

9. The system of claim 8 , wherein the state information results from business logic of the application program.

10. The system of claim 9 , wherein the state information comprises internal variables of the application program.

11. The system of claim 8 , wherein the processor is further configured to train the constraints model with normal state information from the executed application program under normal operation.

12. The system of claim 8 , wherein the one or more constraints address security vulnerabilities in a business logic of an application layer of the application program.

13. The system of claim 8 , wherein the one or more constraints include at least one of an allowable range for an internal variable, an allowable state transition sequence, or an expected state dependent internal variable value.

14. The system of claim 8 , wherein the processor is further configured to apply the one or more constraints to the application program.

15. The system of claim 14 , wherein applying the one or more constraints to the application program includes generating executable code for a processing device running the application program and transmitting the executable code to the processing device.

16. A non-transitory computer-readable storage medium having instructions stored thereon that, when executed by a processor, cause the processor to:

receive state information comprising internal variables generated by an application program executed under normal conditions, wherein the internal variables are associated with a business logic of the application program;

train a constraints model based on the state information;

generate one or more constraints with the constraints model based on a difference between the state information and expected state information, the constraints model configured to output the expected state information, each of the one or more constraints describing an execution constraint for executing the application program, wherein the execution constraint includes at least one of an allowable range for an internal variable, an allowable state transition sequence, or an expected state dependent internal variable value;

generate executable code for a processing device running the application program based on the one or more constraints; and

transmit the executable code to the processing device.

17. The non-transitory computer-readable storage medium of claim 16 , wherein the instructions further cause the processor to apply the one or more constraints to the application program.

18. The non-transitory computer-readable storage medium of claim 17 , wherein applying the one or more constraints to the application program includes generating executable code for a processing device running the application program and transmitting the executable code to the processing device.