Web Application Syscall Baselines for Context-Aware Cyber Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cyber security measures for web applications are inadequate in detecting and preventing malicious activities, particularly in serverless environments, due to the complexity of web applications and the inability to accurately monitor and analyze system calls (syscalls) within the context of their runtime environment.
Innovation Solution
A supervisor process monitors syscalls made by the runtime process of a web application, creates a context-aware baseline segmented into micro components, and prevents execution of syscalls that deviate from this baseline, while maintaining application execution and accessing the runtime context to enhance detection accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional cyber security measures are used to monitor web applications, then basic security monitoring is provided, but detection accuracy of malicious activities is insufficient due to inability to analyze syscalls within runtime context
Solution Approach 1:
The patent segments the web application into micro-components (URL endpoints, libraries, dependencies) and creates separate baselines for each component. This segmentation allows the system to monitor and analyze syscalls at a granular level within their specific runtime contexts, significantly improving detection accuracy without requiring a monolithic complex monitoring system.
Solution Approach 2:
The patent introduces a supervisor process as an intermediary between the runtime environment and the monitoring system. This supervisor process captures runtime context (stack traces, HTTP requests, environment variables) and provides it to the baseline matching engine, enabling accurate syscall analysis without directly instrumenting the application code.
2Reliability
If comprehensive syscall monitoring is implemented to detect malicious activities, then security detection capability is improved, but normal application operations may be disrupted
Solution Approach 1:
The patent creates context-aware baselines during a learning phase before production deployment. These baselines capture the normal syscall behavior of each micro-component in its runtime context. During operation, the system compares actual syscalls against these pre-established baselines, allowing it to distinguish normal operations from malicious activities without disrupting application continuity.
Solution Approach 2:
The patent implements dynamic baseline creation and updating capabilities. The system can adapt to changes in application behavior over time by updating baselines, ensuring that legitimate operational changes are not flagged as anomalies while maintaining security detection effectiveness.
3Measurement precision
If context-aware baseline creation is implemented for each micro component, then syscall deviation detection accuracy is improved, but computational resources and processing time are increased
Solution Approach 1:
By segmenting the application into micro-components and creating separate baselines for each, the system can process and compare syscalls at a granular level. This segmentation reduces the computational complexity compared to analyzing the entire application as a monolith, as each baseline is smaller and more focused, enabling faster matching operations.
Solution Approach 2:
The patent implements periodic baseline creation during a learning phase, followed by efficient baseline matching during operation. The system periodically updates baselines when changes are detected, rather than continuously recreating them, balancing detection accuracy with computational efficiency.
4Measurement precision
If runtime context access is implemented for each syscall, then detection precision is improved, but system overhead and complexity are increased
Solution Approach 1:
The supervisor process acts as an intermediary that efficiently captures runtime context (stack traces, HTTP requests, environment variables) and associates it with the corresponding syscall. This intermediary approach avoids the complexity of directly accessing runtime context from multiple monitoring points, as the supervisor centralizes context collection and management.
Solution Approach 2:
The patent segments runtime context access by micro-component, creating context-specific baselines for each component. This segmentation allows the system to access and compare only the relevant context for each syscall, reducing the overall complexity compared to managing a single monolithic context for the entire application.
Data Source
AI summary
There is provided a computer implemented method of cyber protection of an application, comprising: monitoring syscalls made by a runtime process executing the application, providing the monitored syscalls made by the runtime process to a supervisor process running externally to a runtime environment, accessing, by the supervisor process, a runtime context of the runtime process executing the application, creating, by the supervisor process, a context-aware baseline including the runtime context of the application segmented into its micro components, and preventing, by the supervisor process, execution of syscalls by the runtime environment executing the application that deviate from the context-aware baseline.