Runtime Application Self-Protection via Targeted Input-Output Instrumentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing Runtime Application Self-Protection (RASP) solutions face high overhead and high false alarm rates due to broad instrumentation across the program flow, which affects performance and accuracy in detecting security vulnerabilities.
Innovation Solution
Targeted instrumentation at specific points in the program flow, such as input and output points, where the application receives data from users or submits queries to sensitive targets, with sensors examining inputs for attack patterns and detectors evaluating outputs for vulnerabilities, minimizing overhead and false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If broad instrumentation is applied across the entire program flow to detect security vulnerabilities, then detection coverage is improved, but system overhead and false alarm rates increase
Solution Approach 1:
The program flow is segmented into critical sections (input points, output points, and sensitive operations) that are instrumented separately. Instead of instrumenting the entire program flow, only these segmented critical points are monitored, reducing overhead while maintaining detection coverage for security-relevant operations.
Solution Approach 2:
Different instrumentation strategies are applied to different parts of the program based on their security importance. Input points use syntax examination for attack patterns, output points use vulnerability evaluation, and sensitive operations use specific detectors. This localized approach optimizes detection effectiveness while minimizing overall overhead.
2Measurement precision
If comprehensive instrumentation is used to monitor all program operations, then detection accuracy is improved, but false alarm rates increase
Solution Approach 1:
Inputs are examined at input points for attack patterns before they can cause harm. By performing preliminary syntax examination and caching potentially malicious inputs at the source, the system can later correlate these with outputs to confirm actual vulnerabilities, reducing false alarms while maintaining detection accuracy.
Solution Approach 2:
The system uses feedback loops where outputs are correlated with cached inputs to determine if vulnerabilities actually occurred. This feedback mechanism allows the system to distinguish between potentially malicious inputs that caused real vulnerabilities versus those that were benign, thereby reducing false alarm rates while maintaining high detection accuracy.
Data Source
AI summary
A method for runtime self-protection of an application program includes, before running the application program, identifying input and output points in runtime code (24) of the program. The input points are instrumented so as to cause the program to sense and cache potentially malicious inputs to the program. The output points are instrumented so as to cause the program to detect outputs from the program corresponding to the cached inputs. While running the application program, upon detecting, at an instrumented output point, an output corresponding to a cached input, a vulnerability of a target of the output to the cached input is evaluated. A protective action is invoked upon determining that the output is potentially vulnerable to the cached input.