Systems and methods for neutralizing malicious code with nested executuion contexts
AssigneeSeraphic Algorithms Ltd.
InventorAvihay Cohen
Life of this patent
Estimating the term…
Abstract
A non-transitory computer readable medium contains instructions that when executed cause one or more processors to perform cybersecurity operations that include detecting an interpreter-based application configured to exhibit native functionality and to generate a plurality of execution contexts following receipt of an original input code. An interpreter-based cybersecurity agent is injected within the detected interpreter-based application, which is itself configured for execution by the interpreter-based application prior to execution of the original input code. Exposed APIs are patched using the injected interpreter-based cybersecurity agent to cause patched APIs to exhibit non-native functionality in order to thwart exploitations.
Claims27
1-38. (canceled)
A non-transitory computer-readable medium containing instructions executable by at least one processor to perform operations for neutralizing malicious code, the operations comprising:
- accessing an interpreter-based application associated with a first execution context having at least one first-execution-context exposed API;
- executing a first intercepting code prior to execution of first-execution-context input code, the first intercepting code being configured to patch the at least one first-execution-context exposed API;
- determining whether the first-execution-context input code generates a second execution context having at least one second-execution-context exposed API;
- and
- executing a second intercepting code prior to execution of second-execution-context input code, the second intercepting code being configured to patch the at least one second-execution-context exposed API.
A method for neutralizing malicious code, the method comprising:
- accessing an interpreter-based application associated with a first execution context having at least one first-execution-context exposed API;
- executing a first intercepting code prior to execution of first-execution-context input code, the first intercepting code being configured to patch the at least one first-execution-context exposed API;
- determining whether the first-execution-context input code generates a second execution context having at least one second-execution-context exposed API;
- and
- executing a second intercepting code prior to execution of second-execution-context input code, the second intercepting code being configured to patch the at least one second-execution-context exposed API.
(canceled)
(canceled)
(canceled)
(canceled)
A cyber security system for neutralizing malicious code, the system comprising:
- at least one processor configured to:
- access an interpreter-based application associated with a first execution context having at least one first-execution-context exposed API;
- execute a first intercepting code prior to execution of first-execution-context input code, the first intercepting code being configured to patch the at least one first-execution-context exposed API;
- determine whether the first-execution-context input code generates a second execution context having at least one second-execution-context exposed API;
- and
- execute a second intercepting code prior to execution of second-execution-context input code, the second intercepting code being configured to patch the at least one second-execution-context exposed API.
62-65. (canceled)
67-71. (canceled)
Dependencies are inferred from the claim text.