BACKGROUND

There are various types of ransomware attacks. In a “file-based attack,” an end-user may receive a file and then access the file. Such access of the file triggers execution of harmful software within the file that interferes with the operations of the end-user's computer system. In some cases, the harmful software introduced via the file may lock down the computer system rendering it completely unusable by the end-user. In a “file-less” attack, harmful software may probe be sent to a computer system to take advantage of buffer overflows and memory corruption vulnerabilities in order to insert harmful software into the computer system. Conventional ransomware security upgrades for software applications currently exist where end-users are offered a choice between adding security features or opting out of the offered security upgrade entirely.

SUMMARY

Conventional techniques for applying security features to an application result in a degradation of the application's performance. Such security features are applied to the application prior to occurrence of an attack (or security threat). For example, security features may be applied to the entirety of the application's source code since the type of a future potential attack is unknown. Therefore, the applied security features are broad in scope and effect various measures of the application's performance and efficiency. However, an actual attack of the application may only effect certain aspects of the application's performance which indicates that the conventional techniques apply more security features than is necessary. As such, conventional techniques do not apply security features at a granular level with respect to specific performance measures so as to control the performance trade-offs that inevitably occur when adding security functionality to an application.

Various embodiments of methods, systems and computer program products described herein are directed to a Security Engine. The Security Engine selects post-attack security upgrades of an application by selecting specific security hardening passes to be applied to a pre-attack state of the application. According to various embodiments, the Security Engine receives a pre-attack state of a first instance of an application in response to an action by an attack source. The Security Engine selects one or more security hardening passes to be applied to the pre-attack state. The Security Engine sends an identification of the selected security hardening passes to be applied to a second instance of the application running at the pre-attack state.

According to various embodiments, the Security Engine implements a reinforcement learning algorithm to determine which types of security hardening passes are to be applied—and in what order—to an application in order to secure the vulnerabilities of an application that were already exploited by an attack source.

According to various embodiments, a parent process runs processes of the same application at a computer device that is separate from the Security Engine. For example, the Security Engine may be a service implemented via a cloud computing platform that communicates with the computer device. The parent process detects an attack on a first process of the application. The parent process runs an idle second process of the application running at a pre-attack state of the application. The parent process sends the pre-attack state (i.e. a stack trace) to the Security Engine. The Security Engine selects a sequence of hardening security passes, according to the reinforcement learning algorithm, that balances modifying the application with security features that directly address the threat posed by the detected attack with maintaining optimal application performance.

The Security Engine sends the selected sequence of hardening security passes to the parent process to be applied to the idle second process by the parent process. The idle second process consists of the application running at the pre-attack state and the parent process updates the idle second process with the selected sequence of hardening security passes while the attacked first process fails (i.e. crashes) due to the attack.

Further areas of applicability of the present disclosure will become apparent from the detailed description, the claims and the drawings. The detailed description and specific examples are intended for illustration only and are not intended to limit the scope of the disclosure.

