Jfrog, Ltd.

Vdoo Connected Trust Ltd.

Or Peles

Asaf Karas

Meir Tsvi

Anton Nayshtut

Shmuel Ur

Omer Schory

Shachar Menashe

Ori Hollander

A system, a method, and a computer program product for identification of command injection attacks. The system comprises processors, devices connected to a network, a memory, and an execution platform connected to the devices via the network and capable of executing executable products of execution commands provided thereto by the devices. At least one of the processors is configured to analyze execution commands provided to the execution platform to identify input provisioning or execution events, and determine whether they correlate to the suspicious record event, to perform a remedial action prior to attempting to execute them. When determining that the input includes a command separator and an executable product, the processor records a suspicious event. In response to identifying a potential execution event, determine that an execution command configured to be executed thereby correlates to the suspicious event, and flag the execution command as a command injection attack.

Identification of command injection attacks

A method, a computer program product and an apparatus for online detection of command injection attacks in a computerized system. The method comprises determining that an input of a potential input provisioning event received from a network includes a command separator and an executable product and recording a suspicious record event. The method further comprises determining that an execution command configured to be executed a potential execution event correlates to the suspicious record event and in response to said determining flagging the execution command as a command injection attack. The method further comprises performing a remedial action with respect to the flagged command injection attack prior to attempting to execute the execution command.

Online command injection attacks identification

A method and a computer program product and an apparatus for securing communication in heterogeneous networks that include devices with different protection levels. The method comprises monitoring, by a security agent installed on a device, communication between the device and external devices. The method comprises determining a level of in-device protection for each device based on available protection thereof. The method further comprises employing, by the security agent, an associated security policy for communications originating from the device, based on the level of in-device protection; such as resources utilized for employing security policies for communications originating from devices are correlated with the protection levels thereof. The method may further comprise enabling sharing security workload between device having trusted security agents to improve performance efficiency thereof.

Cyber-security in heterogeneous networks

A method, system and product for command injection identification. An input hook function is configured to be executed in response to a potential input provisioning event. The input hook function is configured to perform: analyzing a potential input of the potential input provisioning event to identify whether the potential input comprises a command separator and an executable product; and in response to identifying the command separator and the executable product, recording a suspicious input event indicating the command separator and the executable product. An execution hook function is configured to be executed in response to a potential execution event. The execution hook function is configured to perform: in response to a determination that an execution command of the potential execution event comprises the command separator and the executable product of the suspicious input event, flagging the execution command as a command injection attack.

Command injection identification

A method, system and product, configured to perform: during an execution of a program, obtaining boundaries of a stack frame of a function that is currently present in a stack, wherein said obtaining the boundaries comprises: obtaining a return address of the function in the stack; determining a length of the function using a mapping of return addresses of one or more functions in the program and corresponding lengths of the one or more functions; and determining the boundaries of the stack frame of the function based on a value of a stack pointer of the stack and based on the length of the function; based on the boundaries of the stack frame of the function, determining that the stack frame is overflown; and in response to said determining that the stack frame is overflown, performing a responsive action.

Growing community of inventors

Tel Aviv, Israel

Or Peles