Microservice Runtime Policy Synthesis From System Call Graphs

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing reference monitors in micro-service computing environments lack fully automated approaches for defining stateful policies that accurately describe how a program interacts with system resources, requiring significant manual expertise and focusing on detecting common security issues rather than deriving application-specific policies.

Innovation Solution

A method for automated security policy synthesis involves binary analysis of a program within a container image, generating a graph of expected interactions, and synthesizing a security policy that embeds system call arguments, which is then instantiated in the container environment for runtime monitoring.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Manufacturing precision

If manual policy definition is used, then policy accuracy and applicability are improved, but expert time and cost increase

Engineering Contradiction:

Improvepolicy accuracyVSAvoidexpert time

Core Design Contradiction:

Manufacturing precisionVSLoss of time

Solution Approach 1:

The system performs self-service by automatically generating security policies through binary analysis of container images. The binary analysis platform autonomously extracts system call sequences, constructs behavior graphs, and synthesizes security policies without requiring manual expert intervention, thereby maintaining policy accuracy while eliminating time loss to expert definition

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The system performs preliminary action by conducting binary analysis and policy synthesis during the container image build phase or deployment preparation stage. This advance preparation creates ready-to-use security policies before the container runs, allowing policies to be pre-configured and validated without impacting runtime performance or requiring post-deployment expert adjustment

Inventive Principle:

Principle #10Preliminary action

2Extent of automation

If automated policy generation is used, then expert time is reduced, but policy statefulness and application-specific accuracy deteriorate

Engineering Contradiction:

Improveautomation levelVSAvoidpolicy accuracy

Core Design Contradiction:

Extent of automationVSManufacturing precision

Solution Approach 1:

The system replaces manual mechanical policy definition with automated binary analysis mechanisms. By substituting expert analysis with automated static binary analysis, system call tracing, and graph-based synthesis, the system achieves high automation while maintaining or improving policy accuracy through systematic, reproducible analysis of actual program behavior

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system creates accurate copies of actual program behavior by analyzing system call sequences and constructing behavior graphs that replicate how the application truly interacts with the operating system. This copying approach ensures automated policies accurately reflect application-specific behavior patterns without requiring manual observation or generalization

Inventive Principle:

Principle #26Copying

3Reliability

If common security issue detection is used, then detection coverage is improved, but application-specific security deteriorates

Engineering Contradiction:

Improvedetection coverageVSAvoidapplication-specific security

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system applies local quality by generating customized security policies tailored to each specific application's behavior patterns. Instead of applying uniform common security rules to all containers, the binary analysis platform analyzes each application's unique system call sequences and generates localized policies that address that specific application's security requirements while maintaining overall detection coverage

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The system segments security policy generation into application-specific units by analyzing each container image independently. The binary analysis process breaks down security policy creation into discrete, application-specific behavior graphs and policies, allowing each application to have its own customized security rules while the overall system maintains comprehensive detection coverage across all applications

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS12585493B2Automated synthesis of reference policies for runtime microservice protection

Publication Date: 2026.03.24 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

A method, apparatus and computer program product for automated security policy synthesis and use in a container environment. In this approach, a binary analysis of a program associated with a container image is carried out within a binary analysis platform. During the binary analysis, the program is micro-executed directly inside the analysis platform to generate a graph that summarizes the program's expected interactions within the run-time container environment. The expected interactions are identified by analysis of one or more system calls and their arguments found during micro-executing the program. Once the graph is created, a security policy is then automatically synthesized from the graph and instantiated into the container environment. The policy embeds at least one system call argument. During run-time monitoring of an event sequence associated with the program executing in the container environment, an action is taken when the event sequence is determined to violate the security policy.