Managed software remediation
There is disclosed in one example a remediation server including: a hardware platform, including a processor, a memory, and a network interface; and instructions encoded within the memory to instruct the processor to: receive an application binary; create an application logic model of the application binary; and create personalization rules for the application binary based on the application logic model.
1. A remediation server comprising:
a hardware platform, comprising a processor circuit, a memory, and a network interface; and
instructions encoded within the memory to instruct the processor circuit to:
receive an application binary;
create an application logic model (ALM) of the application binary, wherein creating the ALM comprises disassembling the application binary, modeling application logic according to the disassembling, creating a data flow structure that represents a lifetime of an object that passes through the application logic, and stepping through the ALM while tracking the data flow structure;
determine, from the ALM, runtime application behavior modifications; and
create personalization rules for the application binary, including implementing one or more application behavior modifications.
2. The remediation server of claim 1 , wherein the instructions are further to instruct the processor circuit to:
detect malware behavior in the application binary; and
heal the application binary by inserting or removing instructions to ameliorate the malware behavior and recompile the application binary.
3. The remediation server of claim 1 , wherein creating personalization rules comprises receiving application programming interface (API) intelligence from a platform API intelligence database.
4. The remediation server of claim 1 , wherein creating personalization rules comprises receiving threat intelligence from a global threat intelligence database.
5. The remediation server of claim 1 , wherein creating personalization rules comprises performing heuristic analysis on the application binary.
6. The remediation server of claim 1 , wherein the application logic model comprises structured text configured to contain text objects representing application programming interface (API) elements.
7. A computer-implemented method of providing malware remediation, comprising:
receiving an application binary;
creating an application logic model (ALM) of the application binary, wherein
creating the ALM comprises disassembling the application binary, modeling application logic according to the disassembling, creating a data flow structure that represents a lifetime of an object that passes through the application logic, and stepping through the ALM while tracking the data flow structure;
determine, from the ALM, runtime application behavior modifications; and
creating personalization rules for the application binary including implementing one or more application behavior modifications.
8. The method of claim 7 , further comprising:
detecting malware behavior in the application binary; and
healing the application binary by inserting or removing instructions to ameliorate the malware behavior and recompile the application binary.
9. The method of claim 7 , wherein creating personalization rules comprises receiving application programming interface (API) intelligence from a platform API intelligence database.