Runtime Application Data Flow Monitoring for Security Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security analysis and protection systems face challenges in coping with the high update frequency of modern software applications, as traditional static code analysis and external protection tools require frequent manual updates and complex configurations, making them inefficient in dynamically changing application environments.
Innovation Solution
The implementation of dynamic, run-time instrumentation of code to identify vulnerabilities and detect malicious inputs by placing sensors in the code to track input data from entry points, through manipulation and sanitization operations, and interacting with data sinks, maintaining metadata for trust and sanitization status, and applying countermeasures to prevent attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional static code analysis and external protection tools are used, then security vulnerabilities can be identified, but the systems require frequent manual updates and complex configurations to cope with high update frequency of modern software applications
Solution Approach 1:
The application performs self-security analysis through embedded sensors that automatically monitor data flows, sanitize inputs, and detect vulnerabilities without requiring external protection tools or manual configuration updates. The system serves its own security needs internally.
Solution Approach 2:
The security system transitions from static code analysis to dynamic run-time monitoring, allowing the application to adapt its security measures in real-time as the application code changes frequently. Sensors are placed dynamically based on data flow analysis.
2Reliability
If traditional static code analysis is used, then security vulnerabilities can be detected, but the analysis results become obsolete before they are finished due to rapid product updates
Solution Approach 1:
Security monitoring continues continuously during runtime rather than being performed periodically through static analysis. The sensors constantly track data flows and sanitize inputs, ensuring security protection remains current with every code update without interruption.
Solution Approach 2:
Security measures are built into the application code itself during development, with sensors placed to monitor and sanitize data flows before vulnerabilities can be exploited. This preliminary embedding ensures security keeps pace with code changes.
3Object-affected harmful factors
If external protection systems like firewalls are used, then malicious input can be blocked, but manual changes of configuration data are required to adapt to rapid changes of application deployment and functionality
Solution Approach 1:
The application autonomously monitors and sanitizes its own data inputs through embedded sensors, eliminating the need for external firewalls and their complex manual configurations. The system self-adapts to code changes without human intervention.
Solution Approach 2:
Sensors act as intermediaries between external data sources and the application code, automatically sanitizing inputs and blocking malicious content without requiring external protection systems or manual configuration management.
Data Source
AI summary
A technology to identify processing paths of untrusted input data received by applications that are vulnerable to attacks and to further detect and prevent actual attacks that try to exploit those vulnerabilities is disclosed. Application code is augmented at run-time with sensor code which detects the entry of input-data into the application and further traces the propagation, manipulation and, sanitization of this input-data until its usage in a data sink. The so generated data-flow traces reveal data-flow paths that lack required sanitization measures to neutralize potentially harmful input-data. Such data-flow paths are reported as vulnerabilities. Further, input-data that reaches data-sink interfaces is scanned by data-sink sensors to identify harmful input data. On identification of harmful input data, an attack is reported, and countermeasures are applied to prevent the identified attack.