Dynatrace Software Gmbh

Dynatrace Corporation

Christian Schwarzbauer

Bernd Greifeneder

Andreas Berger

Erich Georg Hochmuth

Stefan Chiettini

Jurgen Richtsfeld

Markus Pfleger

Helmut L Hackl

Rainer Klaffenbock

A technology to identify processing paths of untrusted input data received by applications that are vulnerable to attacks and to further detect and prevent actual attacks that try to exploit those vulnerabilities is disclosed. Application code is augmented at run-time with sensor code which detects the entry of input-data into the application and further traces the propagation, manipulation and, sanitization of this input-data until its usage in a data sink. The so generated data-flow traces reveal data-flow paths that lack required sanitization measures to neutralize potentially harmful input-data. Such data-flow paths are reported as vulnerabilities. Further, input-data that reaches data-sink interfaces is scanned by data-sink sensors to identify harmful input data. On identification of harmful input data, an attack is reported, and countermeasures are applied to prevent the identified attack.

Method and system for data flow monitoring to identify application security vulnerabilities and to detect and prevent attacks

A technology is disclosed to perform real-time and online identification and prioritization of vulnerabilities of components of software applications. Agents are deployed to components of monitored applications that monitor and report application topology, communication, code execution and code loading activity. Reported code loading and execution activity data is used to detect the loading and execution of vulnerable code, topology and communication data is used to create a topology model of the application containing communication paths, trust boundaries and location of sensitive data. The analysis of code loading and execution data reveals the extend to which vulnerable code is used by monitored application components. The topology data combined with code execution data reveals the extent to which components executing vulnerable code are exposed to untrusted entities and/or accessing sensitive data. Execution data of vulnerable code, exposure and access data of components executing the vulnerable code are used to calculate priority scores for identified vulnerabilities.

Method and system for real time detection and prioritization of computing assets affected by publicly known vulnerabilities based on topological and transactional monitoring data

A system and method for tracing individual transactions on method call granularity is disclosed. The system uses instrumentation based transaction tracing mechanisms to enhance thread call stack sampling mechanisms by a) only sampling threads executing monitored transactions while execution is ongoing b) tagging sampled call stacks with a transaction identifier for correlation of sampled call stacks with instrumentation bases tracing data. The combination of instrumentation based tracing with thread call stack sampling reduces sampling generated overhead by only sampling relevant thread, and reduces instrumentation generated overhead because it allows reducing instrumentation.

Method and system for transaction controlled sampling of distributed heterogeneous transactions without source code modifications

A system and method for tracing individual transactions on method call granularity is disclosed. The system uses instrumentation based transaction tracing mechanisms to enhance thread call stack sampling mechanisms by a) only sampling threads executing monitored transactions while execution is ongoing b) tagging sampled call stacks with a transaction id for correlation of sampled call stacks with instrumentation bases tracing data. The combination of instrumentation based tracing with thread call stack sampling reduces sampling generated overhead by only sampling relevant thread, and reduces instrumentation generated overhead because it allows reducing instrumentation.

Transaction tracing mechanism of distributed heterogenous transactions having instrumented byte code with constant memory consumption and independent of instrumented method call depth

The presented enhancement of a rule based instrumentation system taking object oriented inheritance relationships into account is directed to the detection and extraction to inheritance relationships relevant for the instrumentation process. Relevant inheritance relationships which have an impact on the instrumentation process and typically only represent a small fraction of the complete inheritance relationships of a monitored application. The small size of the relevant inheritance relationships allows, for example to prepare it in advance and ship it as part of a monitoring application or to transmit inheritance information between different local instrumentation engines being part of a distributed instrumentation system.

System and method for extracting instrumentation relevant inheritance relationships for a distributed, inheritance rule based instrumentation system

A monitoring system uses existing tracing data describing individual distributed transactions to determine if a recorded thread communication performed by the monitored transactions is internal to a monitored application or whether the recorded thread communication is an outgoing communication. Thread communications which are sent and received by threads that are monitored by the monitoring system are considered to be internal communications. Thread communications for which only the sending thread is monitored are considered to be outgoing communications. The determination process analyzes client side tracing data of the recorded thread communication and determines whether corresponding server side tracing data is available. If no corresponding server side tracing data is available, the thread communication is considered to be an outgoing communications. Examples of thread communications include HTTP requests, web service calls, and remote method invocations.

Method and system for tracing individual transactions at the granularity level of method calls throughout distributed heterogeneous applications without source code modifications including the detection of outgoing requests

A method and system monitor and diagnose the performance of remote method invocations using bytecode instrumentation in distributed multi-tier applications. The method and system use automated instrumentation of client application bytecode and server application bytecode with sensors to measure performance of remote method invocations and operations performed during remote method invocations. Performance information is captured for each remote method invocation separately, allowing performance diagnosis of multithreaded execution of remote method invocations, so that throughput and response time information are accurate even when other threads perform remote method invocations concurrently. The captured performance metrics include throughput and response time of remote method invocation, object serialization, and transport. The performance metrics are captured per remote method invocation. Performance metrics may be sent to a processing unit for storage, analysis, and correlation.

Method and system for automated analysis of the performance of remote method invocations in multi-tier applications using bytecode instrumentation

A method and system for dynamic and adaptive deployment of in-process agents to virtual machine based applications which may run on remote hosts is provided. A bootstrap agent is injected into the application, using standardized interfaces provided by virtual machine based systems like SUN MICROSYSTEMS' JAVA system or MICROSOFT's .NET system. The bootstrap agent establishes a network connection to a management server which provides binaries representing in-process agents in bytecode or native code format. The bootstrap agent sends data identifying its runtime environment to the management server, which determines the matching in-process agent binaries for the runtime environment of the connected agent and sends the selected binaries to the bootstrap agent. The bootstrap agent receives the binaries and installs them to its hosting virtual machine, according to their format (bytecode or native code).

Growing community of inventors

Linz, Austria

Christian Schwarzbauer