Aspects of the invention include receiving, by a processor, source code for a software program written in a first programming language. The received source code is converted into abstracted source code that is in a generic format that is different than a format of the first programming language. The abstracted source code is compared to known source code patterns. Based on determining that at least a subset of the abstracted source code matches a pattern in the known source code patterns, sending an alert to the user indicating that the received source code matches the pattern.

Systems and methods are disclosed for event-based application control. A system extension is configured to leverage an endpoint security API for monitoring event activity within operating system kernel processes. The system extension registers with the endpoint security API particular event types for which the system extension would like to receive notifications. In response to receiving notifications regarding detected events corresponding to the registered event types, the system extension determines if the event, and its corresponding process, are safe and allowable to execute. In various embodiments, the system leverages whitelists, blacklists, and rules policies for making a safeness determination regarding the event notification. The system extension transmits this determination to the operating system via the endpoint security API.

Systems and methods are disclosed for event-based application control. A system extension is configured to leverage an endpoint security API for monitoring event activity within operating system kernel processes. The system extension registers with the endpoint security API particular event types for which the system extension would like to receive notifications. In response to receiving notifications regarding detected events corresponding to the registered event types, the system extension determines if the event, and its corresponding process, are safe and allowable to execute. In various embodiments, the system leverages whitelists, blacklists, and rules policies for making a safeness determination regarding the event notification. The system extension transmits this determination to the operating system via the endpoint security API.

Disclosed herein are systems, methods, and storage media for distributed system security. In an example embodiment, a computer-executable method includes receiving a first item of executable code, calculating a hash of the first item of executable code, and comparing the calculated hash to a database of hashes. Responsive to a determination that the calculated hash does not match any hash in the database of hashes, a first security policy is applied to the first item of executable code. Triggering of the first policy indicates that the first item of executable code should be blocked from execution. If the first item of executable code does not trigger the first security policy, the method includes executing the first item of executable code and intercepting a request initiated by the first item of executable code during execution. In the request matches a second security policy, the request is blocked and/or filtered or sanitized, based on attribute-based access control policies.

Disclosed herein are systems, methods, and storage media for distributed system security. In an example embodiment, a computer-executable method includes receiving a first item of executable code, calculating a hash of the first item of executable code, and comparing the calculated hash to a database of hashes. Responsive to a determination that the calculated hash does not match any hash in the database of hashes, a first security policy is applied to the first item of executable code. Triggering of the first policy indicates that the first item of executable code should be blocked from execution. If the first item of executable code does not trigger the first security policy, the method includes executing the first item of executable code and intercepting a request initiated by the first item of executable code during execution. In the request matches a second security policy, the request is blocked and/or filtered or sanitized, based on attribute-based access control policies.

A compute system includes a security processor, a component, a component memory, a first communication link, and a second communication link. The component memory stores machine readable instructions executable by the component. The first communication link communicatively couples the component memory to the security processor. The second communication link communicatively couples the component memory to the component. The security processor is to cryptographically authenticate the machine readable instructions stored in the component memory in a boot process.

A compute system includes a security processor, a component, a component memory, a first communication link, and a second communication link. The component memory stores machine readable instructions executable by the component. The first communication link communicatively couples the component memory to the security processor. The second communication link communicatively couples the component memory to the component. The security processor is to cryptographically authenticate the machine readable instructions stored in the component memory in a boot process.

The handling of protocol exceptions for deterministic code that communicates with external component(s). A protocol exception host updates an execution state object associated with the deterministic code as the execution of the deterministic code proceeds. The component also detects whether a protocol exception has occurred that was caused by the deterministic code communicating using the protocol with an external component. If the component detects that such a protocol exception has occurred, the component handles the protocol exception. The component also determines whether the handled protocol exception has been successfully handled. If the exception is not successfully handled, the component stops the execution of the deterministic code such that the execution state object includes execution state of the deterministic code up to the stop. Accordingly, the execution state of the deterministic code up to the stop may be later used to resume execution of the deterministic code.

One or more computing devices, systems, and/or methods are provided. In an example, a method comprises executing an application image to initialize a computing system. System state data associated with the initializing of the computing system is stored in a hardware register having at least one lockable until reset bit. A fault condition is identified responsive to the system state data not matching an expected value.

One or more computing devices, systems, and/or methods are provided. In an example, a method comprises executing an application image to initialize a computing system. System state data associated with the initializing of the computing system is stored in a hardware register having at least one lockable until reset bit. A fault condition is identified responsive to the system state data not matching an expected value.