Control flow integrity monitoring based insights

A system comprising:

• one or more processors;
• and
• one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:
• obtaining, at a first computer system, a first control flow graph diagram representing first valid transfers of a first application observed during an observation phase;
• detecting, using the first control flow graph diagram, a first deviation between the first valid transfers and first real-time transfers of the first application executed by the first computer system, the first deviation being indicative of a first invalid transfer being included in the first real-time transfers;
• receiving a first report of the first deviation detected based on first real-time monitoring using the first control flow graph diagram of the first application executing at the first computer system of a first user of a first enterprise network;
• obtaining, at a second computer system, a second control flow graph diagram representing second valid transfers of a second application;
• detecting, using the second control flow graph diagram, a second deviation between the second valid transfers and second real-time transfers of the second application executed by the second computer system, the second deviation being indicative of a second invalid transfer being included in the second real-time transfers;
• receiving a second report of the second deviation detected based on second real-time control flow graph diagram monitoring of the second application running at the second computer system of a second user of a second enterprise network that is different from the first enterprise network;
• generating, based on performing a peer comparison of the first report and the second report, application exploit report data comprising an indication of a pattern or a shared characteristic of the first deviation and the second deviation;
• and
• providing, to a cloud-based exploit reporting tool available to the first computer system, the second computer system, and one or more other computer systems of other enterprise networks, the application exploit report data.

One or more non-transitory computer-readable media storing computer-readable instructions that, when executed by one or more processors, cause the one or more processors to:

• obtain at a first computer system, a first control flow graph diagram representing first valid transfers of a first application observed during an observation phase;
• detect, using the first control flow graph diagram, a first deviation between the first valid transfers and first real-time transfers of the first application executed by the first computer system, the first deviation being indicative of a first invalid transfer being included in the first real-time transfers;
• receive a first report of the first deviation detected based on first real-time monitoring using the first control flow graph diagram of the first application executing at the first computer system of a first client of a first enterprise network;
• obtain, at a second computer system, a second control flow graph diagram representing second valid transfers of a second application;
• detect, using the second control flow graph diagram, a second deviation between the second valid transfers and second real-time transfers of the second application executed by the second computer system, the second deviation being indicative of a second invalid transfer being included in the second real-time transfers;
• receive a second report of the second deviation detected based on second real-time control flow graph diagram monitoring of the second application running at the second computer system of a second client of a second enterprise network that is different from the first enterprise network;
• generate, based on the first report and the second report, application exploit report data comprising an indication of a pattern or a shared characteristic of the first deviation and the second deviation;
• and
• provide, to a cloud-based exploit reporting tool available to the first computer system and the second computer system, the application exploit report data.