Security policies for software call stacks

Patent metadata

Field	Value
Publication number	US-12039031-B2
Application number	US-202017023035-A
Country	US
Kind code	B2
Filing date	Sep 16, 2020
Priority date	Sep 16, 2020
Publication date	Jul 16, 2024
Grant date	Jul 16, 2024

Abstract

The present disclosure provides systems, methods, and computer-readable media for implementing security polices at software call stack level. In one example, a method includes generating a call stack classification scheme for an application, detecting a call stack during deployment of the application; using the call stack classification scheme during runtime of the application, classifying the detected call stack as one of an authorized call stack or an unauthorized call stack to yield a classification; and applying a security policy based on the classification.

First claim

The invention claimed is:

1. A method comprising:
detecting a call stack during a first deployment of an application in a first operating environment;
classifying the detected call stack as an unauthorized call stack based on a first score of the call stack using a classification scheme, wherein the first score is assigned during runtime of the first deployment of the application based in part on a determination that the first operating environment is unsecure;
detecting the call stack during a second deployment of the application in a second operating environment;
classifying the detected call stack as an authorized call stack based on a second score of the call stack using the classification scheme being greater than a threshold, wherein the second score is assigned during runtime of the second deployment of the application based in part on a determination that the second operating environment is secure; and
modifying a security policy based on the classification of the application as unauthorized during the first deployment of the application to authorized during the second deployment of the application, wherein access to the application is denied during the first deployment of the application but is granted during the second deployment of the application,
and wherein the classification scheme including a classifier trained using at least one machine learning technique using a list of previously known authorized call stacks and a list of previously known unauthorized call stacks to train the classifier.

2. The method of claim 1 ,
the classifier trained using the at least one machine learning technique is configured to identify detected call stacks as one of authorized or unauthorized call stacks.

3. The method of claim 2 , wherein the classifier is trained to output the classification of the call stack detected during the runtime as one of the authorized call stack or the unauthorized call stack.

4. The method of claim 1 , wherein classifying the detected call stack further comprises:
comparing the first score to the threshold; and
classifying the call stack as the unauthorized call stack if the score is less than the threshold.

5. The method of claim 1 , the method further comprising:
tracing call stacks during execution of the application;
determining an execution order of each call stack; and
labelling the application as authorized within the call stack application scheme based on the execution order of each call stack.

6. The method of claim 1 , the method further comprising:
tracing call stacks during execution of the application;
based on the tracing, generating a graph of a percentage of each call stack encountered during the execution of the application; and labelling the application as unauthorized or authorized within the call stack application scheme based on the percentage of each call stack encountered during the execution of the application.

7. The method of claim 1 , wherein an execution order of the call stack detected during the runtime of the application is a condition for the call stack classification scheme to authorize or unauthorize the application.

8. The method of claim 1 , the method further comprising:
determining a score for the call stack based on execution order;
comparing the score to a threshold score to classify the call stack as authorized or unauthorized;
based on the call stack being classified as unauthorized, labelling the call stack and the execution order as blacklisted in the call stack classification scheme.

9. The method of claim 1 , wherein the call stack is detected during runtime of the application by Runtime Application Self-Protection (RASP) agents that trace call stack functionality.

10. A system comprising:
one or more memories having computer-readable instruction stored therein; and
one or more processors configured to execute the computer-readable instructions to:
detect a call stack during a first deployment of an application in a first operating environment;
classify the detected call stack as an unauthorized call stack based on a first score of the call stack using a classification scheme, wherein the first score is assigned during runtime of the first deployment of the application based in part on a determination that the first operating environment is not secure;
detect the call stack during a second deployment of the application in a second operating environment;
classify the detected call stack as an authorized call stack based on a second score of the call stack using the classification scheme being greater than a threshold, wherein the second score is assigned during runtime of the second deployment of the application based in part on a determination that the second operating environment is secure; and
modifying a security policy based on the classification of the application as unauthorized during the first deployment of the application to authorized during the second deployment of the application, wherein access to the application is denied during the first deployment of the application but is granted during the second deployment of the application,
and wherein the classification scheme including a classifier trained using at least one machine learning technique using a list of previously known authorized call stacks and a list of previously known unauthorized call stacks to train the classifier.

11. The system of claim 10 , wherein
the classifier trained using the at least one machine learning technique is configured to detected call stacks as one of authorized or unauthorized call stacks.

12. The system of claim 11 , wherein the classifier is trained to output the classification of the call stack detected during the runtime as one of the authorized call stack or the unauthorized call stack.

13. The system of claim 10 , wherein the one or more processors are configured to execute the computer-readable instructions to:
compare the first score to the threshold; and
classify the call stack as the unauthorized call stack if the score is less than the threshold.

14. The system of claim 10 , wherein the one or more processors are configured to execute the computer-readable instructions to:
Trace call stacks during execution of the application;
determine an execution order of each call stack; and
label the application as authorized within the call stack application scheme based on the execution order of each call stack.

15. The system of claim 10 , the method further comprising:
trace call stacks during execution of the application;
based on the tracing, generate a graph of a percentage of each call stack encountered during the execution of the application; and
label the application as unauthorized or authorized within the call stack application scheme based on the percentage of each call stack encountered during the execution of the application.

16. The system of claim 10 , wherein an execution order of the call stack detected during the runtime of the application is a condition for the call stack classification scheme to authorize or unauthorize the application.

17. The system of claim 10 , wherein the call stack is detected during runtime of the application by Runtime Application Self-Protection (RASP) agents that trace call stack functionality.

18. One or more non-transitory computer-readable storage media comprising computer-readable instructions which, when executed by one or more processors of a security system, cause the security system to:
detect a call stack during a first deployment of an application in a first operating environment;
cl

Assignees

• Cisco Tech Inc

Inventors

• Kulshreshtha Ashutosh
• Sloane Andy
• Patel Hiral Shashikant
• Chettiar Uday Krishnaswamy
• Kempe Oliver
• Viswanathan Bharathwaj Sankara
• Yadav Navindra

Classifications

• G06N3/0464

  Convolutional networks [CNN, ConvNet] · CPC title

• G06N3/09

  Supervised learning · CPC title

• G06F18/214

  Generating training patterns; Bootstrap methods, e.g. bagging or boosting · CPC title

• G06F21/577

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/51

  at application loading time, e.g. accepting, rejecting, starting or inhibiting executable software based on integrity or source reliability · CPC title