Systems and methods for inhibiting attacks on applications

摘要

In accordance with some embodiments of the present invention, systems and methods that protect an application from attacks are provided. In some embodiments of the present invention, input from an input source, such as traffic from a communication network, can be routed through a filtering proxy that includes one or more filters, classifiers, and/or detectors. In response to the input passing through the filtering proxy to the application, a supervision framework monitors the input for attacks (e.g., code injection attacks). The supervision framework can provide feedback to tune the components of the filtering proxy.

主权项

1. A method for protecting applications from attacks, the method comprising:
receiving input from an input source that is attempting to reach an application over a communication network; transmitting the received input to a supervision framework that detects an attack on the application and provides feedback relating to the attack to at least one of a signature-based filter and an anomaly-based filter; using the supervision framework to emulate the application with the received input, wherein the emulation further comprises implementing Instruction Set Randomization (ISR) by performing a reversible transformation on at least a portion of the received input by the supervision framework; receiving an indication from the supervision framework that the received input is the attack based on the emulation; and in response to receiving the indication, inhibiting the received input from being transmitted to the application and transmitting instructions relating to the attack that updates at least one of the signature-based filter and the anomaly-based filter.