Systems and methods for interpreter based application cybersecurity
AssigneeSeraphic Algorithms Ltd.
InventorAvihay Cohen
Life of this patent
Estimating the term…
Abstract
A non-transitory computer readable medium contains instructions that when executed cause one or more processors to perform cybersecurity operations that include detecting an interpreter-based application configured to exhibit native functionality and to generate a plurality of execution contexts following receipt of an original input code. An interpreter-based cybersecurity agent is injected within the detected interpreter-based application, which is itself configured for execution by the interpreter-based application prior to execution of the original input code. Exposed APIs are patched using the injected interpreter-based cybersecurity agent to cause patched APIs to exhibit non-native functionality in order to thwart exploitations.
Claims18
A non-transitory computer readable medium containing instructions that when executed by at least one processor cause the at least one processor to:
- detect at least one interpreter-based application, wherein the at least one interpreter-based application is configured to exhibit native functionality and to generate a plurality of execution contexts following receipt of an original input code;
- inject an interpreter-based cybersecurity agent within the at least one detected interpreter-based application, wherein the injected interpreter-based cybersecurity agent is configured for execution prior to execution of the original input code by the at least one interpreter-based application;
- patch exposed application programming interfaces using the injected interpreter-based cybersecurity agent, wherein the patching is configured to cause the exposed application programming interfaces to become patched application programming interfaces that exhibit non-native functionality different from the native functionality, and wherein the non-native functionality differs for differing execution contexts of the at least one interpreter-based application in order to thwart exploitations;
- intercept, using the injected interpreter-based cybersecurity agent, an invocation of the patched application programming interfaces;
- and
- split arguments of the invocation into a plurality of memory arrays corresponding to the plurality of execution contexts.
A method for performing cybersecurity operations, the method comprising:
- detecting at least one interpreter-based application, wherein the at least one interpreter-based application has a plurality of execution contexts and is configured to exhibit native functionality;
- injecting an interpreter-based cybersecurity agent within the at least one detected interpreter-based application, wherein the injected interpreter-based cybersecurity agent is configured for execution prior to code associated with the at least one interpreter-based application;
- patching exposed application programming interfaces using the injected interpreter-based cybersecurity agent, wherein the patching is configured to cause the exposed application programming interfaces to become patched application programming interfaces that exhibit non-native functionality different from the native functionality, and wherein the non-native functionality differs for differing execution contexts of the at least one interpreter-based application in order to circumvent exploitations;
- intercepting, using the injected interpreter-based cybersecurity agent, an invocation of the patched application programming interfaces;
- and
- splitting arguments of the invocation into a plurality of memory arrays corresponding to the plurality of execution contexts.
A system for performing cybersecurity operations, comprising:
- at least one processor configured to:
- detect at least one interpreter-based application stored in at least one memory, wherein the at least one interpreter-based application has a plurality of execution contexts and is configured to exhibit native functionality,
- inject an interpreter-based cybersecurity agent within the at least one detected interpreter-based application, wherein the injected interpreter-based cybersecurity agent is configured for execution prior to code associated with the interpreter-based application;
- patch exposed application programming interfaces using the injected interpreter-based cybersecurity agent, wherein the patching is configured to cause the exposed application programming interfaces to become patched application programming interfaces that exhibit non-native functionality different from the native functionality, and wherein the non-native functionality differs for differing execution contexts of the interpreter-based application in order to circumvent exploitations;
- and
- intercept, using the injected interpreter-based cybersecurity agent, an invocation of the patched application programming interfaces;
- and
- split arguments of the invocation into a plurality of memory arrays corresponding to the plurality of execution contexts.
Dependencies are inferred from the claim text.