Granted Patent B1

US 12,730,899 · App. 18/449,908 · Granted Sep 8, 2026

Inventors: Christien R. Rioux (Leesburg, VA); Yijou Chen (Cupertino, CA)

Assignee: FORTINET, INC.

G06F21/577G06F21/55G06F2221/033

Abstract

Claims (43)

1 . A method comprising:

inspecting, using static code analysis, a non-executable representation of an application to identify one or more points in the application for monitoring; and

for each of the one or more points in the application:

generating a monitoring program configured to:

detect that the application is preparing to take a particular action by determining that a pending data communications connection will be established a known malicious entity; and

prevent the application from taking the particular action; and

inserting, into an executable representation of the application, the monitoring program at a location in the executable representation of the application that corresponds to the identified point in the application.

2 . The method of claim 1 wherein inspecting, using static code analysis, a non-executable representation of the application includes inspecting source code for the application that is stored in a code repository.

3 . The method of claim 1 wherein inspecting, using static code analysis, a non-executable representation of the application includes inspecting an intermediate representation of the application as the application is being compiled.

4 . The method of claim 1 further comprising creating a monitoring program repository, wherein each monitoring program is associated with an identification of an application and a point within the application where the monitoring program should be determined.

5 . The method of claim 4 further comprising creating an entry in the monitoring program repository for a generated monitoring program.

6 . The method of claim 1 further comprising:

detecting, by a particular monitoring program, that the application is preparing to take a monitored action; and

preventing the application from taking the monitored action.

7 . The method of claim 1 wherein a particular monitoring program is configured to inspect data communications messages generated by the application prior to the application sending the data communications messages.

8 . The method of claim 1 wherein a particular monitoring program is configured to monitor for known exploitable conditions.

9 . A system comprising one or more computing devices configured to carry out:

inspecting, using static code analysis, an application to identify one or more points in the application for monitoring; and

for each of the one or more points in the application:

generating a monitoring program configured to:

detect that the application is preparing to take a particular action by determining that a pending data communications connection will be established a known malicious entity; and

prevent the application from taking the particular action; and

inserting, into the application, the monitoring program at a location in the executable representation of the application that corresponds to the identified point in the application.

10 . The system of claim 9 wherein inspecting, using static code analysis, the application includes inspecting source code for the application that is stored in a code repository.

11 . The system of claim 9 wherein inspecting, using static code analysis, the application includes inspecting an intermediate representation of the application as the application is being compiled.

12 . The system of claim 9 wherein the steps further comprise creating a monitoring program repository, wherein each monitoring program is associated with an identification of an application and a point within the application where the monitoring program should be determined.

13 . The system of claim 12 wherein the steps further comprise creating an entry in the monitoring program repository for a generated monitoring program.

14 . The system of claim 9 wherein the steps further comprise:

detecting, by a particular monitoring program, that the application is preparing to take a monitored action; and

preventing the application from taking the monitored action.

15 . The system of claim 9 wherein a particular monitoring program is configured to inspect data communications messages generated by the application prior to the application sending the data communications messages.

16 . The system of claim 9 wherein a particular monitoring program is configured to monitor for known exploitable conditions.

17 . A computer program product comprising a non-transitory computer readable medium storing computer program instructions that, when executed, carry out:

inspecting, using static code analysis, a non-executable representation of an application to identify one or more points in the application for monitoring; and

for each of the one or more points in the application:

generating a monitoring program configured to:

detect that the application is preparing to take a particular action by determining that a pending data communications connection will be established a known malicious entity; and

prevent the application from taking the particular action; and

inserting, into an executable representation of the application, the monitoring program at a location in the executable representation of the application that corresponds to the identified point in the application.

18 . The computer program product of claim 17 wherein the computer program instructions, when executed, further carry out:

detecting, by a particular monitoring program, that the application is preparing to take a monitored action; and

preventing the application from taking the monitored action.

19 . The computer program product of claim 17 wherein inspecting, using static code analysis, a non-executable representation of the application includes inspecting source code for the application that is stored in a code repository.

Assignments (2)

Continuity (7)

References Cited (400)