Code instrumentation for runtime application self-protection

Apparatus for runtime self-protection of an application program, comprising:

• a memory, which is configured to receive runtime code of the program;
• and
• a processor, which is configured to identify, before the program is run, input and output points in the runtime code, to instrument the input points so as to cause the program, while the program is running, to sense and cache potentially malicious inputs to the program, and to instrument the output points with instrumentation that causes the program, while the program is running, to detect outputs from the program corresponding to the cached inputs, and upon detecting an output corresponding to a cached input, to evaluate a vulnerability of a target of the output to the cached input and to invoke protective action upon determining that the output is potentially vulnerable to the cached input.

A computer software product for runtime self-protection of an application program, comprising a non-transitory computer-readable medium in which program instructions are stored, which instructions, when read by a computer, cause the computer to receive runtime code of the program, and to identify, before the program is run, input and output points in the runtime code, and to instrument the input points so as to cause the program, while the program is running, to sense and cache potentially malicious inputs to the program, and to instrument the output points with instrumentation that causes the program, while the program is running, to detect outputs from the program corresponding to the cached inputs, and causes the program, upon detecting an output corresponding to a cached input, to evaluate a vulnerability of a target of the output to the cached input and to invoke protective action upon determining that the output is potentially vulnerable to the cached input.