Automated synthesis of reference policies for runtime microservice protection

Apparatus, comprising:

• at least one hardware processor;
• computer memory holding computer program instructions executed by the at least one hardware processor to perform automated security policy synthesis and use in a container environment, the computer program instructions comprising program code configured to:
• perform binary analysis, within a binary analysis platform (BAP), of a program associated with a container image, wherein the binary analysis comprises micro-execute the program directly inside the BAP to generate a call graph that summarizes expected interactions of the program within the container environment, and wherein the BAP implements whole program micro-execution and provides a framework for performing analysis on binaries lifted into a BAP intermediate language, and wherein nodes of the call graph comprise function calls of the program, and wherein each node of the call graph stores unique term identifier (ID) that issues a system call, and wherein the unique term ID identifies a specific location within the BAP intermediate language representation, and wherein the BAP defines an application binary interface (ABI) that models behavior of functions of a library external to the BAP without requiring micro-execution of the functions;
• automatically synthesize a security policy from the call graph, wherein the security policy comprises valid sequences of system calls made by the program during its micro-execution, wherein a given sequence of system calls is valid if there exists a path in the call graph that matches the given sequence;
• instantiate the security policy into the container environment;
• and
• during runtime monitoring of the program executing in the container environment, receive real-time telemetry of the program's execution and take an action when the real-time telemetry is determined to violate the security policy, wherein the real-time telemetry comprises a set of system call sequences of the program captured during its execution, and wherein the security policy is violated where the real-time telemetry includes a system call sequence not within the security policy.

A computer program product in a non-transitory computer-readable medium for use in a data processing system, the computer program product holding computer program instructions executed by the data processing system to perform automated security policy synthesis and use in a container environment, the computer program instructions comprising program code configured to:

• perform binary analysis, within a binary analysis platform (BAP), of a program associated with a container image, wherein the binary analysis comprises micro-execute the program directly inside the BAP to generate a call graph that summarizes expected interactions of the program within the container environment, and wherein the BAP implements whole program micro-execution and provides a framework for performing analysis on binaries lifted into a BAP intermediate language, and wherein nodes of the call graph comprise function calls of the program, and wherein each node of the call graph stores a unique term identifier (ID) that issues a system call, and wherein the unique term ID identifies a specific location within the BAP intermediate language representation, and wherein the BAP defines an application binary interface (ABI) that models behavior of functions of a library external to the BAP without requiring micro-execution of the functions;
• automatically synthesize a security policy from the call graph, wherein the security policy comprises valid sequences of system calls made by the program during its micro-execution, wherein a given sequence of system calls is valid if there exists a path in the call graph that matches the given sequence;
• instantiate the security policy into the container environment;
• and
• during runtime monitoring of the program executing in the container environment, receive real-time telemetry of the program's execution and take an action when the real-time telemetry is determined to violate the security policy, wherein the real-time telemetry comprises a set of system call sequences of the program captured during its execution, and wherein the security policy is violated where the real-time telemetry includes a system call sequence not within the security policy.