JavaScript API Interception for Exploit-Resistant Memory Layouts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current cyber defense technologies fail to prevent or detect advanced threats in JavaScript-enabled applications due to the sophistication of modern browsers and the limitations of OS-level monitoring, especially on restricted devices like smart TVs and smartphones, where OS-level solutions are not applicable.
Innovation Solution
A system and method that injects an intercepting code into JavaScript applications to manipulate API invocations, creating a chaotic execution environment by randomizing memory layouts and object properties, preventing malicious code from exploiting predictable behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If JavaScript is used to enable rich interactivity and user experience in applications, then application functionality and user engagement are improved, but the attack surface for exploits and malicious code increases
Solution Approach 1:
The system performs preliminary actions by instrumenting JavaScript code during the build or deployment phase to insert security checks, sandboxing mechanisms, and exploit detection logic before the application runs in production. This allows security measures to be pre-configured without affecting runtime performance significantly.
Solution Approach 2:
The patent introduces an intermediary security layer that sits between the JavaScript runtime and the application logic. This intermediary monitors code execution, detects malicious patterns, and blocks exploits while allowing legitimate application functionality to proceed uninterrupted.
2Reliability
If comprehensive security scanning and analysis tools are deployed to detect exploits, then security detection capability is improved, but system complexity and processing overhead increase
Solution Approach 1:
The security analysis system is segmented into multiple specialized components: static analysis modules for code review, dynamic analysis modules for runtime monitoring, sandboxing engines for isolated execution, and pattern matching systems for exploit detection. Each segment handles specific security tasks independently, reducing overall system complexity while maintaining comprehensive coverage.
Solution Approach 2:
The system dynamically adjusts analysis parameters such as scanning depth, inspection intensity, and resource allocation based on the risk level of the application and the type of security threat being detected. This allows the system to optimize between detection capability and processing overhead by changing operational parameters rather than restructuring the entire system.
3Loss of time
If real-time code analysis and neutralization is performed during application execution, then exploit response time is improved, but application performance and execution speed deteriorate
Solution Approach 1:
The system implements periodic security analysis at strategically chosen points in the application execution lifecycle rather than continuous monitoring. Security checks are performed at code entry points, before sensitive operations, and at interval-based checkpoints, allowing the application to execute freely between checks and maintaining optimal performance while still detecting exploits in real-time.
Solution Approach 2:
The patent creates isolated copies or sandboxed instances of potentially malicious code for analysis, allowing security scanning to occur on replicas rather than the actual executing code. This enables thorough real-time analysis without impacting the performance of the primary application execution, as the copied code runs in separate memory spaces with minimal overhead.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A computer-implemented method comprising: receiving, by an application capable of JavaScript execution, a code for execution; injecting, before the execution, an intercepting code into the received code, wherein the intercepting code is configured to intercept all application programming interface (API) invocations by the received code; intercepting, by the intercepting code, an API invocation by the received code; determining that the intercepted API invocation, and results in a manipulation of a backing store object; and modifying an execution of the intercepted API invocation, wherein the modified execution results in a non-predictable memory layout.