Application Vulnerability Protection via Behavioral Restriction Rules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software vulnerabilities in computer systems are exploited by hackers during the time interval between discovery and correction, posing a significant risk to corporate networks and user data, as existing solutions are inadequate in providing immediate protection.
Innovation Solution
A system that detects software vulnerabilities by analyzing typical and anomalous actions of applications, creates restriction rules to block atypical actions, and automatically installs updates to mitigate identified vulnerabilities, thereby controlling the execution of applications and enhancing security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If developers create updates to eliminate vulnerabilities, then security reliability is improved, but the time interval between vulnerability discovery and correction increases exposure risk
Solution Approach 1:
The system performs preliminary actions by proactively monitoring for vulnerability indicators and preparing restriction rules before exploits are deployed. When a vulnerability is detected in an application, the system immediately creates and applies restriction rules that block potential exploit actions, rather than waiting for official updates to be developed and distributed.
Solution Approach 2:
The system applies preliminary anti-action by implementing restriction rules that preemptively block harmful actions associated with known vulnerabilities. These rules are designed based on analysis of exploit behavior patterns and are applied immediately upon detecting a vulnerable application, counteracting potential attacks before they can execute.
2Stability of the object's composition
If administrators test updates before deployment, then system stability is improved, but the time to implement vulnerability corrections increases
Solution Approach 1:
The system introduces an intermediary solution by implementing restriction rules that act as a protective layer between the vulnerable application and potential exploits. These rules are applied immediately to block harmful actions, while administrators simultaneously test and deploy official updates at their own pace without time pressure.
Solution Approach 2:
The system provides beforehand cushioning by deploying restriction rules that cushion the system against potential exploit attacks during the update testing period. This protective measure allows administrators to conduct thorough testing without increasing the vulnerability exposure window.
3Loss of information
If users are notified about security bulletins, then awareness of vulnerabilities is improved, but hackers can also use the same information to create exploits
Solution Approach 1:
The system applies the other way round approach by inverting the traditional security model. Instead of relying on users to read and understand security bulletins and manually apply updates, the system automatically monitors for vulnerability indicators, analyzes application behavior, and implements protective restriction rules without requiring user awareness or action regarding specific vulnerabilities.
Solution Approach 2:
The system implements self-service by autonomously performing vulnerability detection, analysis, and protection without requiring user intervention. The system automatically monitors applications, detects vulnerability indicators, creates restriction rules based on exploit pattern analysis, and applies these rules to block potential attacks, making the security process self-acting rather than user-dependent.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are systems, methods and computer program products for protecting computer systems from software vulnerabilities. In one aspect, a system is configured to detect execution of a software application and determine whether the detected application has vulnerabilities. When the application has vulnerabilities, the system may analyze the application to identify typical actions performed by the application. The system may then create one or more restriction rules based on the identified typical actions of the application. The restriction rules allow application to perform typical actions and block atypical actions. The system then controls execution of the application using the created restriction rules.