Apparatus and method for analyzing and supplementing a program to provide security
First Claim
Patent Images
1. A non-transitory computer readable storage medium, comprising executable instructions to:
- perform an automated analysis of program instructions using a security module to analyze application output prior to the program instructions being invoked, wherein the automated analysis includes an automated analysis of injection vulnerabilities, an automated analysis of potential repetitive attacks including session ID guessing, credential guessing, click fraud and site probing, an automated analysis of sensitive information, and an automated analysis of specific HTTP attributes;
select and insert protective instructions into the program instructions based on the automated analysis of the injection vulnerabilities, wherein the protective instructions comprise a call that generates a security event during runtime; and
utilize a runtime security module to detect and respond to attacks by analyzing the generated security event during execution of the program instructions.
11 Assignments
0 Petitions
Accused Products
Abstract
A computer readable storage medium has executable instructions to perform an automated analysis of program instructions. The automated analysis includes at least two analyses selected from an automated analysis of injection vulnerabilities, an automated analysis of potential repetitive attacks, an automated analysis of sensitive information, and an automated analysis of specific HTTP attributes. Protective instructions are inserted into the program instructions. The protective instructions are utilized to detect and respond to attacks during execution of the program instructions.
-
Citations
17 Claims
-
1. A non-transitory computer readable storage medium, comprising executable instructions to:
-
perform an automated analysis of program instructions using a security module to analyze application output prior to the program instructions being invoked, wherein the automated analysis includes an automated analysis of injection vulnerabilities, an automated analysis of potential repetitive attacks including session ID guessing, credential guessing, click fraud and site probing, an automated analysis of sensitive information, and an automated analysis of specific HTTP attributes; select and insert protective instructions into the program instructions based on the automated analysis of the injection vulnerabilities, wherein the protective instructions comprise a call that generates a security event during runtime; and utilize a runtime security module to detect and respond to attacks by analyzing the generated security event during execution of the program instructions. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12)
-
-
13. A non-transitory computer readable storage medium, comprising executable instructions to:
-
perform an automated analysis of program instructions using a security module to analyze application output prior to the program instructions being invoked, wherein the automated analysis includes a separate automated analysis of potential repetitive attacks including; session ID guessing, credential guessing, click fraud, and site probing; select and insert protective instructions into the program instructions in response to and based on the automated analysis, wherein the protective instructions comprise a call that generates a security event during runtime; and utilize a runtime security module to invoke a runtime security module that operates to detect and respond to attacks by analyzing the generated security event during execution of the program instructions. - View Dependent Claims (14, 15, 16, 17)
-
Specification