# US 12,001,564 B2 · Runtime application monitoring without modifying application program code > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,001,564 B2 - Document ID: US12001564B2 - Status: Granted - Kind: B2 - Application number: 17/287,057 - Filed: 2020-04-24 - Published: 2022-03-10 - Granted: 2024-06-04 - Earliest claimed: 2020-04-24 - Assignees: Veracode, Inc. - Applicants: Veracode, Inc. - Inventors: Christien R. Rioux; Robert Anthony Layzell - Web page: https://patentgrep.com/patent/US12001564B2 ## CPC - G06F 9/4484: {Executing subprograms} - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 11/302: {where the computing system component is a software system} - G06F 11/3093: {Configuration details thereof, e.g. installation, enabling, spatial arrangement of the probes} - G06F 11/3466: {Performance evaluation by tracing or monitoring} - G06F 11/3612: {by runtime analysis (performance monitoring G06F11/3466)} - G06F 2201/865: Monitoring of software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract To facilitate runtime monitoring and analysis of an application without modifying the actual application code, an agent monitors and analyzes an application through detection and evaluation of invocations of an API of a runtime engine provided for execution of the application. The agent registers to receive events which are generated upon invocation of target functions of the runtime engine API based on its load. Once loaded, the agent initially determines the language and language version number of the runtime engine. The agent determines associations of events for which to monitor and corresponding analysis code to execute upon detection of the invocations based on the language and version number information. When the agent detects an event during execution of the application based on invocations of the runtime engine API, the agent can monitor and analyze execution of the application based on execution of analysis code corresponding to the detected event. ## Claims ### Claim 1 A method comprising: based on loading an application into a runtime engine, loading an agent into the runtime engine; determining, by the agent, a language of the runtime engine; determining, by the agent, a plurality of target functions of an application programming interface (API) of the runtime engine based, at least in part, on the language of the runtime engine; for each target function of the plurality of target functions of the API of the runtime engine, the agent associating the target function with a corresponding one of a plurality of analysis code units of the agent, wherein associating the target function with the analysis code unit causes execution of the analysis code unit based on invocation of the target function by the runtime engine; based on the runtime engine invoking a first of the plurality of target functions during execution of the application, detecting, by the agent, a first event that corresponds to the invocation of the first target function; and executing the corresponding one of the plurality of analysis code units that was associated with the target function. ### Claim 2 (depends on 1) The method of claim 1, wherein the agent detecting the first event comprises the agent obtaining at least one of data and metadata of the first event. ### Claim 3 (depends on 2) The method of claim 2, further comprising the agent evaluating the at least one of the obtained data and metadata of the first event based on executing the corresponding one of the plurality of analysis code units. ### Claim 4 (depends on 3) The method of claim 3, further comprising the agent detecting a first vulnerability of the application based, at least in part, on evaluating the at least one of the obtained data and metadata of the first event. ### Claim 5 (depends on 1) The method of claim 1, further comprising the agent determining a version number of the language of the runtime engine, wherein determining the plurality of target functions of the API of the runtime engine is also based on the version number of the language of the runtime engine. ### Claim 6 (depends on 1) The method of claim 1, wherein associating the target function call with the corresponding one of the plurality of analysis code units comprises registering a callback function, and wherein the callback function comprises the corresponding one of the plurality of analysis code units. ### Claim 7 (depends on 1) The method of claim 1, wherein associating the target function with the corresponding one of the plurality of analysis code units comprises hooking an event corresponding to the target function with the corresponding one of the plurality of analysis code units, and wherein the corresponding one of the plurality of analysis code units comprises an event handler. ### Claim 8 (depends on 1) The method of claim 1, further comprising: determining a generation rule for generating a plurality of method stubs based on the language of the runtime engine, wherein the plurality of method stubs correspond to the plurality of target functions; generating the plurality of method stubs based on the generation rule and code units associated with the API; and making accessible the plurality of method stubs to the agent, wherein determining the plurality of target functions of the API is also based on the plurality of method stubs. ### Claim 9 (depends on 8) The method of claim 8, wherein generating the plurality of method stubs comprises generating a header file for the plurality of method stubs, and wherein the header file comprises a precompiled header file. ### Claim 10 (depends on 1) The method of claim 1, wherein the agent and the application execute in parallel or concurrently. ### Claim 11 One or more non-transitory machine-readable media comprising program code for monitoring execution of an application in a runtime engine by an agent, the program code to: load the agent into the runtime engine based on load of the application into the runtime engine; determine a language of the runtime engine based, at least in part, on the load of the agent; determine at least a first target function of an application programming interface (API) of the runtime engine based, at least in part, on the determined language of the runtime engine; associate the first target function with a first analysis code unit, wherein the association causes execution of the first analysis code unit based on invocation of the first target function by the runtime engine; and based on detection of a first event that corresponds to invocation of the first target function by the runtime engine during execution of the application, execute the first analysis code unit. ### Claim 12 (depends on 11) The non-transitory machine-readable media of claim 11, further comprising program code to evaluate the first event, wherein evaluation of the first event is based on execution of the first analysis code unit. ### Claim 13 (depends on 11) The non-transitory machine-readable media of claim 11, further comprising program code to determine a version number of the language of the runtime engine based on the load of the agent, wherein the determination of the first target function is also based on the version number of the language. ### Claim 14 (depends on 11) The non-transitory machine-readable media of claim 11, wherein the first analysis code unit comprises a callback function, and wherein the program code to associate the first target function with the first analysis code unit comprises program code to register the callback function. ### Claim 15 (depends on 11) The non-transitory machine-readable media of claim 11, wherein the program code to associate the first target function with the first analysis code unit comprises program code to hook the first target function with an event handler, and wherein the event handler comprises the first analysis code unit. ### Claim 16 An apparatus comprising: a processor; and a machine-readable medium having first program code and agent program code, the first program code executable by the processor to cause the apparatus to load the agent program code into a runtime engine based on load of an application into the runtime engine; the agent program code executable in the runtime engine to, determine a language of the runtime engine based, at least in part, on loading of the agent program code; determine a plurality of target functions of an application programming interface (API) of the runtime engine based, at least in part, on the language of the runtime engine; for each target function of the plurality of target functions of the API of the runtime engine, associate the target function with a corresponding one of a plurality of analysis code units, wherein association of the target function with the analysis code unit causes execution of the analysis code unit upon invocation of the target function by the runtime engine; based on the runtime engine invoking a first of the plurality of target functions during execution of the application, detect a first event that corresponds to the invocation of the target function; and execute the corresponding one of the plurality of analysis code units that was associated with the target function. ### Claim 17 (depends on 16) The apparatus of claim 16, further comprising agent program code executable in the runtime engine to evaluate at least one of data and metadata of the first event based on execution of the corresponding one of the plurality of analysis code units, wherein the agent program code executable in the runtime engine to detect the first event comprises agent program code executable in the runtime engine to obtain the at least one of data and metadata of the first event. ### Claim 18 (depends on 16) The apparatus of claim 16, further comprising agent program code executable in the runtime engine to determine a version number of the language of the runtime engine, wherein the agent program code executable in the runtime engine to determine the plurality of target functions of the API comprises agent program code executable in the runtime engine to determine the plurality of target functions of the API based on the version number of the language of the runtime engine. ### Claim 19 (depends on 16) The apparatus of claim 16, wherein the agent program code executable in the runtime engine to associate the target function with the corresponding one of the plurality of analysis code units comprises agent program code executable in the runtime engine to register a callback function, wherein the callback function comprises the corresponding one of the plurality of analysis code units. ### Claim 20 (depends on 16) The apparatus of claim 16, wherein the agent program code executable in the runtime engine to associate the target function with the corresponding one of the plurality of analysis code units comprises agent program code executable in the runtime engine to hook an event corresponding to the target function with the corresponding one of the plurality of analysis code units, wherein the corresponding one of the plurality of analysis code units comprises an event handler.