Detection and healing of vulnerabilities in computer code

A method comprising:

• during compiling of executable code to be executed on one or more processing devices, performing operations comprising:
• identifying instances of candidate code in the executable code based on a static analysis of the executable code, the instances of candidate code comprising code in the executable code that is vulnerable to attack or the instances of candidate code being on a path to code in the executable code that is vulnerable to attack, the code that is vulnerable to attack comprising at least an instruction that is susceptible to influence by user-system or system-system interactions, that is repeatable, and that has a predictable memory access pattern;
• and
• during execution of the executable code on the one or more processing devices, the one or more processing devices performing operations comprising:
• inserting a healing template into a version of the executable code at a location that is based on a location of an instance of the candidate code in the executable code, the healing template comprising code that is executable to inhibit the attack;
• identifying which of the instances of candidate code was actually subject to the attack at run-time;
• and
• updating the healing template to produce an updated healing template, the updated healing template comprising information that represents a path and a state that caused the attack.

One or more non-transitory machine-readable media storing instructions comprising:

• instructions, which are executable during compiling of executable code to be executed on one or more processing devices, to perform operations comprising:
• identifying candidate code in the executable code based on a static analysis of the executable code, the candidate code comprising code in the executable code that is vulnerable to attack or the candidate code being on a path to code in the executable code that is vulnerable to attack, the code that is vulnerable to attack comprising at least an instruction that is susceptible to influence by user-system or system-system interactions, that is repeatable, and that has a predictable memory access pattern, where information related to the attack is based, at least in part, on the candidate code;
• and
• instructions, which are executable during execution of the executable code on the one or more processing devices, to perform operations comprising:
• determining that the candidate code was actually targeted by the attack;
• customizing a generic healing template based on the information to produce a customized healing template, the customized healing template comprising code that is executable to inhibit at least some occurrence of the attack;
• and
• inserting the customized healing template into a version of the executable code at a location that is based on a location of the candidate code in the executable code.

One or more non-transitory machine-readable media storing instructions comprising:

• instructions, which are executable during compiling of executable code to be executed on one or more processing devices, to perform operations comprising:
• identifying instances of candidate code in the executable code based on a static analysis of the executable code, the instances of candidate code comprising code in the executable code that is vulnerable to attack or the instances of candidate code being on a path to code in the executable code that is vulnerable to attack, the code that is vulnerable to attack comprising at least an instruction that is susceptible to influence by user-system or system-system interactions, that is repeatable, and that has a predictable memory access pattern;
• and
• instructions, which are executable during execution of the executable code on the one or more processing devices, to perform operations comprising:
• inserting a healing template into a version of the executable code at a location that is based on a location of an instance of the candidate code in the executable code, the healing template comprising code that is executable to inhibit the attack;
• identifying which of the instances of candidate code was actually subject to the attack at run-time;
• and
• updating the healing template to produce an updated healing template, the updated healing template comprising information that represents a path and a state that caused the attack.

A system comprising:

• machine storage storing instructions, which are executable during compiling of executable code to be executed on one or more processing devices, to performing operations comprising:
• identifying candidate code in the executable code based on a static analysis of the executable code, the candidate code comprising code in the executable code that is vulnerable to attack or the candidate code being on a path to code in the executable code that is vulnerable to attack, the code that is vulnerable to attack comprising at least an instruction that is susceptible to influence by user-system or system-system interactions, that is repeatable, and that has a predictable memory access pattern, where information related to the attack is based, at least in part, on the candidate code;
• and
• the one or more processing devices to execute instructions, which are executable during execution of the executable code, to perform operations comprising:
• determining that the candidate code was actually targeted by the attack;
• customizing a generic healing template based on the information to produce a customized healing template, the customized healing template comprising code that is executable to inhibit at least some occurrence of the attack;
• and
• inserting the customized healing template into a version of the executable code at a location that is based on a location of the candidate code in the executable code.

A method comprising:

• machine storage storing instructions, which are executable during compiling of executable code to be executed on one or more processing devices, to performing operations comprising:
• identifying instances of candidate code in the executable code based on a static analysis of the executable code, the instances of candidate code comprising code in the executable code that is vulnerable to attack or the instances of candidate code being on a path to code in the executable code that is vulnerable to attack, the code that is vulnerable to attack comprising at least an instruction that is susceptible to influence by user-system or system-system interactions, that is repeatable, and that has a predictable memory access pattern;
• the one or more processing devices to execute instructions, which are executable during execution of the executable code, to perform operations comprising:
• and
• inserting a healing template into a version of the executable code at a location that is based on a location of an instance of the candidate code in the executable code, the healing template comprising code that is executable to inhibit the attack;
• identifying which of the instances of candidate code was actually subject to the attack at run-time;
• and
• updating the healing template to produce an updated healing template, the updated healing template comprising information that represents a path and a state that caused the attack.