.svg)
.svg)
Use case · Runtime Application Security for Servers
Prevent Supply Chain Attacks
Malicious code can hide inside a library loaded by your server application, waiting for a request or background job to activate it. Raven prevents covered unauthorized actions before they execute.
/ 02 — SCENARIOS
Hidden in a library. Activated at runtime.
SCENARIO A
A request activates the payload
A compromised library is loaded inside your server application. A particular request reaches the hidden malicious code, which attempts an unauthorized network connection or process launch.
SCENARIO B
A background job activates the payload
A compromised dependency is loaded by a server worker. Its malicious code stays dormant until a scheduled job, queue message or other runtime trigger reaches it.
/ 03 — MECHANISM
Prevent the unauthorized action at runtime.
1
Attribute the action
When library code attempts a sensitive network, file or process operation, Raven reconstructs the execution path and identifies the library chain behind it.
2
Enforce the library's policy
Deny a covered action that the library chain is not permitted to perform, before that action takes place.
3
Preserve the evidence
Record the attempted action, responsible library chain, server workload and enforcing policy so your team can see what was prevented.
/ 04 — EVIDENCE
See runtime prevention in action.
Inspect a prevention event from a running server application. See the loaded library, the outbound connection its activated code attempted, and the policy that denied it. Tie the evidence to the tested workload and trigger.
3
2
1
1
The library activated at runtime
The loaded library and execution chain in the recorded server event.
2
The connection that was prevented
The attempted destination and recorded denial outcome.
3
The policy that enforced it
The active policy identifier tied to that same event.
The demonstration library is a test fixture with synthetic data — a controlled reproduction of a compromised dependency.
Protection inside your running servers.
Protect server application runtime without changing application source code.
Enforce policy on covered library actions reached by requests or background processing.
Give security and engineering a shared record of the prevented action.
/ 06 — FAQ
Questions before you deploy
Does the package need a known CVE?
No. A malicious package may abuse ordinary capabilities without exploiting a named vulnerability. Raven enforces permitted runtime behavior for the library chain behind the action.
What if the malicious code activates days later?
Dormant library code can activate when a later request or job reaches it. Raven evaluates covered sensitive actions against the active runtime policy when they are attempted.
Is this limited to incoming web requests?
No. Malicious library code can also be reached by background jobs, queue messages or scheduled tasks. Enforcement applies to covered actions inside protected server workloads.
Prevent malicious library behavior. Inside your running servers.
See how Raven prevents an unauthorized action when hidden malicious code activates inside a server application, with the runtime evidence to explain it.
