Runtime memory protection (RMP) engine

A method for protecting a computer application from code injection attacks, the method comprising:

• receiving representations of events occurring with respect to memory locations associated with a computer application;
• processing the received representations to identify a given event that includes:
• a memory write request, a memory permissions change request, and a thread create request;
• responsive to identifying the given event, declaring a code injection attack;
• and
• in response to declaring the code injection attack, implementing a protection action, thereby protecting the computer application from the code injection attack.

A computer program product for protecting a computer application from code injection attacks, the computer program product comprising:

• one or more non-transitory computer-readable storage devices and program instructions stored on at least one of the one or more storage devices, the program instructions, when loaded and executed by a processor, cause an apparatus associated with the processor to:
• receive representations of events occurring with respect to memory locations associated with a computer application;
• process the received representations to identify a given event that includes:
• a memory write request, a memory permissions change request, and a thread create request;
• responsive to identifying the given event, declare a code injection attack;
• and
• in response to declaring the code injection attack, implement a protection action, thereby protecting the computer application from the code injection attack.