Apparatus and Method for Monitoring Program Invariants to Identify Security Anomalies

• US 20090282480A1
• Filed: 05/08/2009
• Published: 11/12/2009
• Est. Priority Date: 05/08/2008
• Status: Abandoned Application

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Lee, Edward, West, Jacob, Madou, Matias, Chess, Brian
• Application Number:
  US12/463,334
• Publication Number:
  US 20090282480A1
• Time in Patent Office: Days
• US Class Current: 726/22
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures

Abstract

A computer readable storage medium includes executable instructions to insert monitors at selected locations within a computer program. Training output from the monitors is recorded during a training phase of the computer program. Program invariants are derived from the training output. During a deployment phase of the computer program, deployment output from the monitors is compared to the program invariants to identify security anomalies.

Claims

1. A computer readable storage medium, comprising executable instructions to:

insert monitors at selected locations within a computer program;

record training output from the monitors during a training phase of the computer program;

derive program invariants from the training output; and

compare, during a deployment phase of the computer program, deployment output from the monitors to the program invariants to identify security anomalies.

2. The computer readable storage medium of claim 1 wherein the security anomalies include illegitimate attacks upon a computer program considered to be legitimate.

3. The computer readable storage medium of claim 1 wherein the executable instructions to insert include executable instructions to insert monitors at computer program write locations.

4. The computer readable storage medium of claim 3 wherein the executable instructions to insert include executable instructions to insert monitors at computer program HTTP write locations to prevent cross-site scripting.

5. The computer readable storage medium of claim 1 wherein the executable instructions to insert include executable instructions to insert monitors at computer program query execution locations.

6. The computer readable storage medium of claim 5 wherein the executable instructions to insert include executable instructions to insert monitors at computer program SQL query execution locations to prevent SQL injection attacks.

7. The computer readable storage medium of claim 1 wherein the program invariants have associated program context.

8. The computer readable storage medium of claim 1 further comprising executable instructions to supply a security response.

9. The computer readable storage medium of claim 8 wherein the security response is an exception.

10. The computer readable storage medium of claim 8 wherein the security response is a log entry.

11. The computer readable storage medium of claim 8 wherein the security response is a displayed message.

12. The computer readable storage medium of claim 8 wherein the security response is an alert to a system monitor.