# US 10,771,494 B2 · Runtime protection of web services > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,494 B2 - Document ID: US10771494B2 - Status: Granted - Kind: B2 - Application number: 16/257,336 - Filed: 2019-01-25 - Published: 2019-05-23 - Granted: 2020-09-08 - Earliest claimed: 2014-06-18 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corporation - Inventors: Omer Tripp; Emmanuel Wurth - Web page: https://patentgrep.com/patent/US10771494B2 ## CPC - H04L 63/1433: {Vulnerability analysis} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 2221/033: Test or assess software - G06F 2221/2101: Auditing as a secondary aspect - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Protecting a runtime Web service application. A web service application is instrumented to log its operation and allow recreation of its execution trace. Trace point vulnerabilities are identified using one or more data payloads. Candidate trace point operations associated with the trace point vulnerabilities are identified. Supplementary candidate operations are computed based on the existing trace point operations and the one or more data payloads. The Web service application is further instrumented with the one or more supplementary candidate operations. ## Claims ### Claim 1 A computer-implemented method for protecting a runtime Web service application, the method comprising: instrumenting, by a computer, the Web service application to log its operation and create an execution trace; identifying, by the computer, a trace point vulnerability using one or more data payloads and one or more security rules; identifying, by the computer, a first candidate trace point operation associated with the trace point vulnerability; computing, by the computer, a supplementary candidate operation based on the first candidate trace point operation and the trace point vulnerability, wherein the supplementary candidate operation addresses a difference between a transformation required to satisfy a security rule and a transformation performed by the first candidate trace point operation; and further instrumenting, by the computer, the Web service application with the supplementary candidate operation. ### Claim 2 (depends on 1) The method of claim 1, wherein the identified trace point vulnerability is reported. ### Claim 3 (depends on 1) The method of claim 1, further comprising applying, by the computer, a fix in the form of a trace point operation to the Web service application. ### Claim 4 (depends on 1) The method of claim 1, wherein a candidate trace point operation is the operation for which a payload value has been rejected by a validator or has been sanitized by a sanitizer. ### Claim 5 (depends on 1) The method of claim 1, further comprising repeating the identifying a trace point vulnerability and the identifying a first candidate trace point operation operations after the Web service application has been instrumented with the supplementary candidate operation. ### Claim 6 (depends on 5) The method of claim 5, wherein when a trace point vulnerability is located that is the same as a previously identified trace point vulnerability, no further operations are taken. ### Claim 7 (depends on 5) The method of claim 5, wherein when a new trace point vulnerability is located, performing the identifying a trace point vulnerability and the identifying a first candidate trace point operation. ### Claim 8 A computer program product for protecting a runtime Web service application, the computer program product comprising: one or more computer-readable storage media and program instructions stored on the one or more computer-readable storage media, the program instructions executable by a processor to perform a method comprising: instrumenting the Web service application to log its operation and create an execution trace; identifying a trace point vulnerability using one or more data payloads and one or more security rules; identifying a first candidate trace point operation associated with the trace point vulnerability; computing a supplementary candidate operation based on the first candidate trace point operation and the trace point vulnerability, wherein the supplementary candidate operation addresses a difference between a transformation required to satisfy a security rule and a transformation performed by the first candidate trace point operation; and further instrumenting the Web service application with the supplementary candidate operation. ### Claim 9 (depends on 8) The computer program product of claim 8, wherein the identified trace point vulnerability is reported. ### Claim 10 (depends on 8) The computer program product of claim 8, wherein the method further comprises applying a fix in the form of a trace point operation to the Web service application. ### Claim 11 (depends on 8) The computer program product of claim 8, wherein a candidate trace point operation is the operation for which a payload value has been rejected by a validator or has been sanitized by a sanitizer. ### Claim 12 (depends on 8) The computer program product of claim 8, wherein the method further comprises repeating the identifying a trace point vulnerability and the identifying a first candidate trace point operation operations after the Web service application has been instrumented with the supplementary candidate operation. ### Claim 13 (depends on 12) The computer program product of claim 12, wherein when a trace point vulnerability is located that is the same as a previously identified trace point vulnerability, no further operations are taken. ### Claim 14 (depends on 12) The computer program product of claim 12, wherein the method further comprises, when a new trace point vulnerability is located, performing the identifying a trace point vulnerability and the identifying a first candidate trace point operation. ### Claim 15 A computer system for protecting a runtime Web service application, the computer system comprising: one or more computer processors, one or more computer-readable storage media, and program instructions stored on one or more of the computer-readable storage media for execution by at least one of the one or more processors to perform a method comprising: instrumenting the Web service application to log its operation and create an execution trace; identifying a trace point vulnerability using one or more data payloads and one or more security rules; identifying a first candidate trace point operation associated with the trace point vulnerability; computing a supplementary candidate operation based on the first candidate trace point operation and the trace point vulnerability, wherein the supplementary candidate operation addresses a difference between a transformation required to satisfy a security rule and a transformation performed by the first candidate trace point operation; and further instrumenting the Web service application with the supplementary candidate operation. ### Claim 16 (depends on 15) The computer system of claim 15, wherein the method further comprises applying a fix in the form of a trace point operation to the Web service application. ### Claim 17 (depends on 15) The computer system of claim 15, wherein a candidate trace point operation is the operation for which a payload value has been rejected by a validator or has been sanitized by a sanitizer. ### Claim 18 (depends on 15) The computer system of claim 15, wherein the method further comprises repeating the identifying a trace point vulnerability and the identifying a first candidate trace point operation operations after the Web service application has been instrumented with the supplementary candidate operation. ### Claim 19 (depends on 18) The computer system of claim 18, wherein when a trace point vulnerability is located that is the same as a previously identified trace point vulnerability, no further operations are taken. ### Claim 20 (depends on 18) The computer system of claim 18, wherein the method further comprises, when a new trace point vulnerability is located, performing the identifying a trace point vulnerability and the identifying a first candidate trace point operation.