Abstract: A system generates a runtime binary patch compatible with dynamic object loading, by: detecting differences in code or data between original assembly code and patched assembly code of a program, placing the differences in a plurality of sections of one or more intermediate object files associated with the runtime binary patch, wherein the plurality of sections are used by a linker to construct an executable file; and replacing direct references to objects in the runtime binary patch with two-staged references such that addresses of the objects are read from a placeholder section for dynamic relocations targets. The system loads and applies, by a dynamic linker, the runtime binary patch on the program.

Abstract: Disclosed herein are systems and method for dynamically updating classes in a running application. In one aspect, a method may include identifying an application running within a virtual machine (VM); generating, within the application, a patcher thread for processing patches; instantiating, within the application, a patcher class using a singleton pattern; installing a shutdown hook in the VM to signal the patcher thread to stop operation and release resources during termination of the application; generating a notification that a live patching facility is set up using a system property in the VM; detecting and executing, via the patcher thread, a task to replace an existing version of a class with an updated version of the class at runtime by scanning, using a polling technique, a tasks directory for new class files and finding the updated version of the class.

Abstract: Disclosed herein are systems and method for detecting malware signatures in replica databases. In one exemplary aspect, a method includes identifying a plurality of replica databases corresponding to a master database. In response to detecting a change in at least one entry of a first replica database of the plurality of replica databases, the method includes analyzing the change for malware. In response to detecting malware, the method includes executing a remediation action to resolve the malware.

Abstract: A system detects, on a source code management system, a pull request from an upstream version of a software to one or more target versions of the software. When the pull request is detected, the system executes backporting by: collecting input parameters associated with the pull request from the source code management system, wherein the collected input parameters comprise a patch; and for each target version of the software: the system analyzes the input parameters using a first machine learning model (MLM) to determine whether the target version is affected by the patch, generates, by a second MLM, an adapted patch that adapts the patch to a source code of the target version, wherein the first MLM indicates that the target version is affected by the patch; and applies the adapted patch on the target version via the source code management system.

Abstract: Disclosed herein are systems and method for migrating units of a program between virtual memory regions. A method includes: dividing system virtual memory into a set of virtual memory regions; storing (1) program code including instructions in a set of code units and (2) program variables and data values in a set of data units, wherein the set of code units and the set of data units are spread across the set of virtual memory regions; in response to detecting that a trigger condition of a first security policy is satisfied, executing a transfer action of the first security policy that transfers a code unit and/or data unit from an origin virtual memory region to a destination virtual memory region.

Abstract: A system identifies one or more designated memory areas for temporary crash data storage using at least one predefined rule. In response to detecting a system failure event, the system captures and writes crash data to the one or more designated memory areas, wherein the system failure event triggers a reboot. Subsequent to the reboot, the system retrieves the crash data from the one or more designated memory areas. The system performs an integrity check on the retrieved crash data. In response to determining that the integrity check is successful, the system stores the retrieved crash data in a file system.

Abstract: Disclosed herein are systems and method for removing malicious code from a script without compromising script functionality. In one aspect, the method includes: identifying, in a script, at least one string corresponding to a malicious pattern; generating an abstract syntax tree (AST) of the script; identifying, in the AST, a parent operator associated with the at least one string; determining an absolute position and length of a node representing the parent operator in the AST; and removing malicious code from the script based on the absolute position and length of the node.

Abstract: Disclosed herein are systems and method for migrating units of a program between virtual memory regions. A method includes: dividing system virtual memory into a set of virtual memory regions; storing (1) program code including instructions in a set of code units and (2) program variables and data values in a set of data units, wherein the set of code units and the set of data units are spread across the set of virtual memory regions; in response to detecting that a trigger condition of a first security policy is satisfied, executing a transfer action of the first security policy that transfers a code unit and/or data unit from an origin virtual memory region to a destination virtual memory region.

Abstract: Disclosed herein are systems and methods for detecting malware in scripts. A method includes: monitoring, at a first computing device, an execution flow of at least one portion of a script; computing a fingerprint that represents the execution flow; determining whether the fingerprint is present in a local fingerprint database that includes a plurality of entries for known scripts; in response to determining that the fingerprint is not present in the local fingerprint database, transmitting the fingerprint to a central database server including a universal fingerprint database; in response to receiving an indication that the fingerprint is not present in the universal fingerprint database, scanning the at least one portion of the script for malware; and blocking the script in response to determining that the at least one portion of the script includes malware based on the scanning.

Abstract: Disclosed herein are systems and method for removing malicious code from a script without compromising script functionality. In one aspect, the method includes: identifying, in a script, at least one string corresponding to a malicious pattern; generating an abstract syntax tree (AST) of the script; identifying, in the AST, a parent operator associated with the at least one string; determining an absolute position and length of a node representing the parent operator in the AST; and removing malicious code from the script based on the absolute position and length of the node.

Abstract: Disclosed herein are systems and methods for automatic detection, fixing, and monitoring of vulnerabilities. In one aspect, an exemplary method comprises receiving as an input an artifact, when the received artifact is vulnerable, building the artifact for a new release, scanning a library containing the new release of the artifact to determine whether the library is safe for publishing, and publishing the library to an accessible artifact depository when the library is safe for publishing. In one aspect, the building of the artifact for the new release includes, scanning a dependency tree, replacing the vulnerable version by a safe version of the artifact when a safe version is available, fixing the vulnerable version of the artifact using known patches when a safe version of the artifact is not available, adding a postfix to a group ID of the artifact for distinguishing the fixed version from prior versions of the artifact.

Abstract: Disclosed herein are systems and method for detecting and resolving account compromise, the method comprising: configuring a web application firewall (WAF) to monitor events in a web application following a successful login into a user account of the web application; collecting, by the WAF, event data of a user session on the web application; determining whether the collected event data comprises malicious activity by comparing the collected event data to historic event data indicative of the malicious activity; in response to determining, by the WAF, that the collected event data corresponds to the historic event data: storing an indication that the user account is compromised in a database; generating an alert indicating that the user account is compromised, wherein the alert comprises a prompt to reset a password of the user account; and blocking, by the WAF, further access to the user account in the user session.

Abstract: Disclosed herein are systems and method for blocking malicious script execution. In one exemplary aspect, the method includes determining, on a first computing device of a plurality of computing devices, that a first script on the first computing device is malicious. The method includes identifying a plurality of operations in an execution flow of the first script and generating a first hash value of attributes associated with the plurality of operations in the execution flow, wherein the attributes omit a name of the first script and a location of the first script on the first computing device. The method includes generating a first rule that prevents execution of any script whose generated hash value would match the first hash value of the first script and transmitting the first rule to a second computing device that subsequently blocks scripts based on the first rule.

Abstract: Disclosed herein are systems and method for dynamically updating classes in a running application. In one aspect, a method may include identifying an application running within a virtual machine (VM); generating, within the application, a patcher thread for processing patches; instantiating, within the application, a patcher class using a singleton pattern; installing a shutdown hook in the VM to signal the patcher thread to stop operation and release resources during termination of the application; generating a notification that a live patching facility is set up using a system property in the VM; detecting and executing, via the patcher thread, a task to replace an existing version of a class with an updated version of the class at runtime by scanning, using a polling technique, a tasks directory for new class files and finding the updated version of the class.

Abstract: Disclosed herein are systems and method for deduplicating malware scan attempts. In one exemplary aspect, a method may include: receiving, from a first computing device of a plurality of computing devices in a network, a first hash value of an object and a verdict of a malware scan performed on the object by the first computing device; storing the first hash value and the verdict in a shared verdict database; receiving, from a second computing device in the network, a verdict request including a second hash value; determining that the first hash value and the second hash value match; in response to determining the match, transmitting, to the second computing device, the verdict of the malware scan performed on the object by the first computing device, wherein the second computing device does not perform a redundant malware scan on the object.

Abstract: Disclosed herein are systems and methods for automatic detection, fixing, and monitoring of vulnerabilities. In one aspect, an exemplary method comprises receiving as an input an artifact, when the received artifact is vulnerable, building the artifact for a new release, scanning a library containing the new release of the artifact to determine whether the library is safe for publishing, and publishing the library to an accessible artifact depository when the library is safe for publishing. In one aspect, the building of the artifact for the new release includes, scanning a dependency tree, replacing the vulnerable version by a safe version of the artifact when a safe version is available, fixing the vulnerable version of the artifact using known patches when a safe version of the artifact is not available, adding a postfix to a group ID of the artifact for distinguishing the fixed version from prior versions of the artifact.

Abstract: Disclosed herein are systems and method for automated malicious code replacement. In one exemplary aspect, a method may comprise scanning for malicious content in a file comprising a script written in an interpretable programming language, wherein the malicious content triggers malicious activity on a computing device that stores the file. The method may comprise detecting a malware injection in the file based on the scanning, wherein the malware injection comprises at least one operator that enables the malicious activity. The method may comprise identifying a benign operator that can replace the at least one operator to prevent execution of the malicious activity without causing a syntax error. The method may comprise updating the file by replacing the at least one operator with the benign operator.

Abstract: Disclosed herein are systems and methods for loading an agent into a virtual machine. In one aspect, a method may include receiving a path to an agent and an options string, wherein the agent comprises a set of classes built to perform an action, resolving, using a process identifier, an identity of a first process comprising a virtual machine instance that has not been augmented by the agent on a host. The method may include performing augmentation on the process by: changing an original identity of a current operating system process to the first identity in response to determining that the current operating system process is privileged, injecting the agent into the virtual machine instance with the path and the options string as arguments of an injection, and reinstating the original identity of the current operating system process.

Abstract: Aspects of the disclosure describe methods and systems for detecting malicious entities using weak passwords for unauthorized access. In one exemplary aspect, a method may comprise intercepting, using a WAF, a password input during a login attempt to a web application by an entity. In response to determining that the password is in a database of weak passwords, the method may comprise generating for display, using the WAF, a web page prompting for a password reset for the web application, storing, in a database, an IP address of the entity and information about the login attempt, retrieving information about a first plurality of login attempts made by the entity in the web application for different user profiles. In response to determining that at least a first threshold number of login attempts have been performed by the entity, the method may comprise storing the IP address in a black list.

Abstract: Disclosed herein are systems and method for detecting and resolving account compromise, the method comprising: configuring a web application firewall (WAF) to monitor events in a web application following a successful login into a user account of the web application; collecting, by the WAF, event data of a user session on the web application; determining whether the collected event data comprises malicious activity by comparing the collected event data to historic event data indicative of the malicious activity; in response to determining, by the WAF, that the collected event data corresponds to the historic event data: storing an indication that the user account is compromised in a database; generating an alert indicating that the user account is compromised, wherein the alert comprises a prompt to reset a password of the user account; and blocking, by the WAF, further access to the user account in the user session.