Managed software remediation

Patent metadata

Field	Value
Publication number	US-12021892-B2
Application number	US-201916382805-A
Country	US
Kind code	B2
Filing date	Apr 12, 2019
Priority date	Sep 27, 2013
Publication date	Jun 25, 2024
Grant date	Jun 25, 2024

Abstract

There is disclosed in one example a remediation server including: a hardware platform, including a processor, a memory, and a network interface; and instructions encoded within the memory to instruct the processor to: receive an application binary; create an application logic model of the application binary; and create personalization rules for the application binary based on the application logic model.

First claim

What is claimed is:

1. A remediation server comprising:
a hardware platform, comprising a processor circuit, a memory, and a network interface; and
instructions encoded within the memory to instruct the processor circuit to:
receive an application binary;
create an application logic model (ALM) of the application binary, wherein creating the ALM comprises disassembling the application binary, modeling application logic according to the disassembling, creating a data flow structure that represents a lifetime of an object that passes through the application logic, and stepping through the ALM while tracking the data flow structure;
determine, from the ALM, runtime application behavior modifications; and
create personalization rules for the application binary, including implementing one or more application behavior modifications.

2. The remediation server of claim 1 , wherein the instructions are further to instruct the processor circuit to:
detect malware behavior in the application binary; and
heal the application binary by inserting or removing instructions to ameliorate the malware behavior and recompile the application binary.

3. The remediation server of claim 1 , wherein creating personalization rules comprises receiving application programming interface (API) intelligence from a platform API intelligence database.

4. The remediation server of claim 1 , wherein creating personalization rules comprises receiving threat intelligence from a global threat intelligence database.

5. The remediation server of claim 1 , wherein creating personalization rules comprises performing heuristic analysis on the application binary.

6. The remediation server of claim 1 , wherein the application logic model comprises structured text configured to contain text objects representing application programming interface (API) elements.

7. A computer-implemented method of providing malware remediation, comprising:
receiving an application binary;
creating an application logic model (ALM) of the application binary, wherein
creating the ALM comprises disassembling the application binary, modeling application logic according to the disassembling, creating a data flow structure that represents a lifetime of an object that passes through the application logic, and stepping through the ALM while tracking the data flow structure;
determine, from the ALM, runtime application behavior modifications; and
creating personalization rules for the application binary including implementing one or more application behavior modifications.

8. The method of claim 7 , further comprising:
detecting malware behavior in the application binary; and
healing the application binary by inserting or removing instructions to ameliorate the malware behavior and recompile the application binary.

9. The method of claim 7 , wherein creating personalization rules comprises receiving application programming interface (API) intelligence from a platform API intelligence database.

Assignees

• Mcafee Llc

Inventors

• Kulkarni Dattatraya
• Nalluri Srikanth
• Sinha Raja
• Krishnapur Venkatasubrahmanyam

Classifications

• H04W12/12

  Detection or prevention of fraud · CPC title

• H04W12/128

  Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware · CPC title

• H04W12/08

  Access security · CPC title

• G06F21/629

  to features or functions of an application · CPC title

• G06F21/6245

  Protecting personal data, e.g. for financial or medical purposes · CPC title