Cyberark Software Ltd.

Nir Chako

Mark Cherp

Asaf Hecht

Eran Shimony

Alon Zahavi

Described herein are methods, systems, and computer-readable storage media for generation of a secure and dynamically mutable operating system. Techniques include receiving a request to execute an application causing instantiation of an operating system by identifying one or more needed modules that include core kernel modules and operating system service modules that are dynamically plugged-in or unplugged based on the execution of the application. Techniques may further include assigning a separate memory space with a separate virtual address for each of the one or more modules, generating a unique cryptographic key for each of the one or more modules, storing each virtual address and corresponding unique cryptographic key together. Further the operating system generation system encrypts each of the one or more modules using their corresponding unique cryptographic key.

Customizable and dynamically mutable operating systems

Disclosed embodiments relate to systems and methods for performing privileged computing actions. Techniques include receiving an indication of a request by an entity to perform a privileged computing operation; determining whether the entity is associated with a privilege needed to perform the privileged computing operation; accessing historical data indicating at least one series of events leading to the entity being associated with the privilege; determining whether the entity is properly associated with the privilege; causing the privileged computing operation to be performed by a secured processing element; and causing a result of the privileged computing operation performed by the secured processing element to be provided to the entity.

Mitigation of privilege escalation

Disclosed embodiments relate to systems and methods for detecting fuzzing activity associated with a target program. Techniques include accessing a target program, monitoring, by a monitoring agent in a kernel space environment, the target program, and analyzing dynamic and static patterns of the target program. The techniques may further include assessing process parameters and inputs, evaluating instrumentation patterns in at least one basic block, assessing process creation frequency, assessing Syscalls invocation frequency, identifying suspicious processes, or comparing a runtime coverage ratio of a process to an expected coverage ratio. Systems and methods may also include calculating a confidence score, including applying a weighted value to an analyzed individual pattern based on the analysis, and identifying a likelihood of fuzzing activity based on the confidence score.

Agent-based detection of fuzzing activity associated with a target program

Disclosed embodiments relate to systems and methods for providing an end-to-end secure lifecycle of data. Techniques include receiving a request from a client to access data; reserving a designated memory region; protecting the designated memory region using access restriction to certain processes of an operating system; receiving data from a trusted source; injecting the data into the designated memory region in a zero-copy manner; sending the data to the client in a zero-copy manner; receiving an indication that the client performed an interaction; and in response to the indication, disposing of the data and the designated memory region.

Growing community of inventors

Petach-Tikva, Israel

Nir Chako