Web Application Syscall Baselines for Serverless Cyber Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cyber security measures for web applications are inadequate in detecting and preventing malicious activities, particularly in serverless environments, as they lack the ability to monitor and analyze syscalls within the context of the application's micro components, leading to inaccurate threat detection and potential disruption of application processes.
Innovation Solution
A system and method that monitors syscalls made by a runtime process, provides them to a supervisor process external to the runtime environment, accesses the runtime context, and creates a context-aware baseline for each micro component to detect deviations, preventing malicious syscalls while maintaining application execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional cyber security measures are used to monitor web applications, then general threat detection is provided, but accurate detection of malicious activities in serverless environments is not achieved
Solution Approach 1:
The patent segments the web application into micro-components (e.g., functions, dependencies, runtime environments) and creates separate baseline profiles for each segment. This segmentation enables precise monitoring of individual components' syscall behavior, allowing accurate detection of malicious activities specific to each micro-component while maintaining context awareness of the overall application architecture.
Solution Approach 2:
The patent implements local quality by creating context-specific baseline profiles for each micro-component based on its unique runtime context, including environment variables, configuration settings, and execution patterns. This allows the security system to apply different detection criteria and thresholds tailored to each component's normal behavior, improving detection accuracy without false positives from generic rules.
2Reliability
If syscall monitoring is implemented to detect malicious activities, then security protection is improved, but application execution may be disrupted
Solution Approach 1:
The patent establishes baseline profiles of normal syscall behavior for each micro-component before malicious activities occur. By pre-defining what constitutes normal operation for each component in its specific runtime context, the system can quickly compare actual syscalls against these baselines and distinguish malicious activities from legitimate operations, preventing false disruptions to application execution.
Solution Approach 2:
The patent implements a feedback mechanism where the security monitoring system continuously compares actual syscall behavior against established baselines and provides real-time feedback. When deviations are detected, the system can dynamically adjust monitoring intensity or trigger specific responses without completely halting application execution, maintaining productivity while ensuring security through continuous adaptation based on observed behavior patterns.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
There is provided a computer implemented method of cyber protection of an application, comprising: monitoring syscalls made by a runtime process executing the application, providing the monitored syscalls made by the runtime process to a supervisor process running externally to a runtime environment, accessing, by the supervisor process, a runtime context of the runtime process executing the application, creating, by the supervisor process, a context-aware baseline including the runtime context of the application segmented into its micro components, and preventing, by the supervisor process, execution of syscalls by the runtime environment executing the application that deviate from the context-aware baseline.