US 12,259,975 B2
Protecting against memory deserialization attacks
Satya V. Gupta, Dublin, CA (US)
Assigned to Virsec Systems, Inc., San Jose, CA (US)
Filed by Virsec Systems, Inc., San Jose, CA (US)
Filed on Dec. 30, 2021, as Appl. No. 17/646,511.
Claims priority of provisional application 63/132,764, filed on Dec. 31, 2020.
Prior Publication US 2022/0215094 A1, Jul. 7, 2022
Int. Cl. G06F 21/56 (2013.01)
CPC G06F 21/56 (2013.01) 21 Claims
OG exemplary drawing
 
1. A computer-implemented method of protecting a software application from a memory deserialization attack, the method including:
decompiling a software application to define a valid linking between classes, between methods, or between at least one class and at least one method of the software application;
receiving a data object at a server hosting the software application;
comparing (i) an aspect of the received data object with (ii) a representation of an expected data object, wherein (a) the aspect of the received data object is a runtime-requested linking between classes, between methods, or between at least one class and at least one method of the software application and (b) the representation of the expected data object is the defined valid linking; and
if the comparing identifies a difference between (i) and (ii), executing a protection action to limit a property of the received data object, thereby protecting the software application from a memory deserialization attack.