Runtime Security (IAST/RASP)
Relevant source files
The following files were used as context for generating this wiki page:
The Runtime Security module in FixOps provides continuous, automated penetration testing and active application self-protection. It bridges the gap between static analysis and production security by validating known vulnerabilities through multi-AI orchestration and real-time exploit simulation. This system integrates interactive testing (IAST) to trace data flows and runtime protection (RASP) to monitor and block active threats such as command injection and protocol abuse.
Within the broader ALDECI framework, runtime security is categorized under "Verify Exploitability" and "Runtime Security events," utilizing tools like Falco and Sysdig to monitor execution state.
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:1-20, samples/api-examples/demo-scenarios/README.md:15-30
Architecture and Core Components
The runtime security architecture is built upon a sidecar model that executes penetration tests and monitors application behavior without arbitrary code execution. The system leverages a "Micro-Pentest Engine" to validate exploitability and a "Business Impact Quantification" engine to translate technical findings into financial risk.
The diagram shows the flow from runtime detection via IAST and RASP monitors into the Micro-Pentest engine, which then triggers AI-driven analysis and final decision-making.
Sources: scripts/micropentest_sidecar.py:1-40, fixops-enterprise/src/services/advanced_pentest_engine.py:1000-1050
Key Data Structures
- ThreatIntelligence: Integrates CISA KEV, EPSS, and NVD scores to prioritize runtime findings.
- BusinessImpactAssessment: Quantifies downtime costs, regulatory fines (GDPR/PCI), and reputation damage.
- AttackChain: Represents a sequence of chained exploits (e.g., Initial Access to Lateral Movement).
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:130-160, fixops-enterprise/src/services/advanced_pentest_engine.py:240-280
Interactive Application Security Testing (IAST)
The IAST implementation (found in risk/runtime/iast.py and risk/runtime/iast_advanced.py) focuses on algorithmic sophistication to trace data through the application lifecycle. It utilizes sophisticated graph algorithms and control flow analysis to identify vulnerabilities that static tools might miss.
Taint Analysis Logic
The system validates code patterns for "Taint Analysis," specifically looking for the propagation of data from a Source (e.g., HTTP request) to a Sink (e.g., SQL query execution).
| Component | Implementation Detail | Description |
|---|---|---|
| Traversal | BFS/DFS | Uses deque or queue structures for broad/deep path analysis. |
| Data Flow | Taint Propagation | Identifies if user-controlled input reaches sensitive functions. |
| Logic | Control Flow Graph (CFG) | Maps execution paths to identify unreachable code or complex bypasses. |
| Statistical | Z-Score/Mean | Applies ML/statistical checks to identify anomalous data patterns. |
Sources: scripts/validate_fixops.py:165-185, tests/e2e/test_real_functionality.py:55-75
Runtime Application Self-Protection (RASP)
The RASP module (risk/runtime/rasp.py) provides defensive capabilities that monitor application execution. It is designed to identify and mitigate "Kill Chain" behaviors in real-time.
The sequence diagram illustrates how the RASP monitor intercepts application calls and consults the AI sidecar for a real-time BLOCK/ALLOW decision.
Sources: scripts/micropentest_sidecar.py:450-500, fixops-enterprise/src/services/advanced_pentest_engine.py:1000-1020
Supported Runtime Events
- Protocol Abuse: Detection of HTTP/2 Rapid Reset (CVE-2023-44487).
- Class Loader Manipulation: Preventing Spring4Shell (CVE-2022-22965) at the execution point.
- JNDI Injection: Blocking Log4Shell (CVE-2021-44228) callback attempts.
Sources: scripts/micropentest_sidecar.py:60-100
Automated Exploit Validation (Micro-Pentest)
The Micro-Pentest engine performs real-time validation of vulnerabilities identified during runtime. It uses a non-destructive approach to verify if a vulnerability is reachable and exploitable in the current environment.
Simulated Attack Chain
The engine can simulate a multi-stage attack to assess the "Blast Radius" of a compromise:
- Initial Access: Exploiting internet-facing services (e.g., Log4Shell on Web Gateway).
- Lateral Movement: Pivating to internal services via webshells (e.g., Spring4Shell on Orders Service).
- Privilege Escalation: Accessing sensitive databases (e.g., PCI-DSS data in Payments DB).
Sources: scripts/micropentest_sidecar.py:480-530
Technical Details Table
| Feature | Implementation | Source File |
|---|---|---|
| CVE Testing | Typer CLI commands (run, batch, demo) | micropentest_sidecar.py |
| Kill Chain | MITRE ATT&CK Mapping (T1190, T1078) | advanced_pentest_engine.py |
| Progress | Rich Animated Progress Bars | micropentest_sidecar.py |
| Provenance | RSA-SHA256 Signed Evidence Bundles | README.md |
Sources: scripts/micropentest_sidecar.py:1-50, fixops-enterprise/src/services/advanced_pentest_engine.py:450-470, samples/api-examples/demo-scenarios/README.md:20-25
Business Impact Quantification
A critical feature of the runtime system is the quantification of findings into business metrics. The BusinessImpactQuantifier uses industry benchmarks (IBM Cost of Data Breach 2024) to estimate financial exposure.
The class diagram shows how impact assessments are calculated based on the criticality of the asset and the classification of the data being protected.
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:200-240
Impact Metrics Calculation
- Downtime Cost: Calculated as
hourly_revenue * estimated_downtime_hours. - Regulatory Risk: Based on compliance frameworks like GDPR (up to 4% of revenue) or HIPAA.
- Breach Cost: Includes detection, notification, post-breach response, and lost business business costs.
Sources: fixops-enterprise/src/services/advanced_pentest_engine.py:240-260, fixops-enterprise/src/services/advanced_pentest_engine.py:650-700
Summary
The Runtime Security module provides a high-fidelity defense layer through the integration of IAST taint analysis and RASP active protection. By leveraging the Micro-Pentest Engine, FixOps moves beyond static "best guess" vulnerability scoring to evidence-based exploit validation. This allows security teams to prioritize remediation based on actual exploitability and quantified financial impact, while the automated evidence bundles ensure a continuous audit trail for compliance frameworks like SOC2 and PCI-DSS.