Getting started with App runtime in .NET

An autonomous security agent that lives inside your .NET application, detecting and responding to threats in real-time with full visibility into code execution, memory, and system state.

What is ByteHide App runtime?

Static analysis tools find vulnerabilities before deployment. Perimeter WAFs block suspicious HTTP traffic in production. Both are valuable. But between them is a gap: the runtime, where vulnerabilities become real exploits and where theoretical risk becomes actual damage.

ByteHide App runtime closes that gap. It is an autonomous security agent that runs inside your application as a parallel process, sharing its memory, permissions, and system access. From inside, it has full visibility into code execution, database interactions, network calls, operating system state, and user sessions.

Because App runtime operates inside the application, it does not rely on pattern matching against HTTP traffic. It intercepts operations at the execution layer. When your code builds a SQL query, App runtime sees the query. When your code resolves a file path, App runtime validates the path. When a process is about to start, App runtime checks the command. This means it can detect zero-day attacks that no signature database has seen yet, because it understands your application's behavior, not just its traffic patterns.

How It Works

App runtime adapts to the environment where your application runs:

Cloud and Web Applications (In-App WAF): For APIs and web applications, the attack surface is the network. App runtime intercepts malicious operations before they execute: SQL queries, file system access, HTTP requests, XML parsing, and more. It operates at the execution layer, not the perimeter, which means encoding tricks and obfuscation techniques that bypass traditional WAFs are ineffective.

Desktop, Mobile, and IoT (RASP Agent): For distributed applications running on devices, the attack surface is the device itself. Attackers decompile, debug, hook, and manipulate your application directly. App runtime detects reverse engineering attempts, compromised devices, memory dumping, process injection, network tampering, and integrity violations.

Same agent. Same dashboard. Same configuration. Different focus.

Choose Your Application Type

Quick Start

Get started in minutes:

using Bytehide.Monitor.Core.Actions;
using Bytehide.Monitor.Core.Protection;

// Standalone applications (Console, Desktop, Mobile, IoT)
await Bytehide.Monitor.Payload.ConfigureAsync(config =>
{
    config.UseToken("your-api-token");
    config.EnableAllProtections(ActionType.Close, intervalMs: 60000);
});

using Bytehide.Monitor.Core.Actions;
using Bytehide.Monitor.Core.Protection;

// Standalone applications (Console, Desktop, Mobile, IoT)
await Bytehide.Monitor.Payload.ConfigureAsync(config =>
{
    config.UseToken("your-api-token");
    config.EnableAllProtections(ActionType.Close, intervalMs: 60000);
});

// ASP.NET Core applications
builder.Services.AddByteHideMonitor(options =>
{
    options.ApiToken = "your-api-token";
    options.EnableSqlInjectionProtection();
    options.EnableXssProtection();
});

app.UseByteHideMonitor();

// ASP.NET Core applications
builder.Services.AddByteHideMonitor(options =>
{
    options.ApiToken = "your-api-token";
    options.EnableSqlInjectionProtection();
    options.EnableXssProtection();
});

app.UseByteHideMonitor();

Protection Capabilities

Desktop and Mobile Protections

Detection modules that run at configurable intervals, monitoring the runtime environment:

Web and Cloud Protections

Active interceptors that validate operations at the execution layer in real-time:

Anomaly Detection (Built-in)

Active by default in every project. Learns your application's normal behavior and flags deviations: authentication anomalies, abnormal request rates, unexpected payload structures, and suspicious session activity. Learn more.

Response System

App runtime does not just detect threats. Because it runs inside your application, it can respond at the point of execution.

Every action is configurable per protection module and per confidence threshold. Low confidence logs. Medium confidence blocks. High confidence terminates and notifies.

config.RegisterCustomAction("secure-shutdown", async (threat) =>
{
    await LogIncidentAsync(threat);
    await NotifySecurityTeamAsync(threat);
    await SecureShutdownAsync();
});

config.AddProtection(
    ProtectionModuleType.DebuggerDetection,
    ActionType.Custom,
    intervalMs: 30000,
    customActionName: "secure-shutdown"
);

config.RegisterCustomAction("secure-shutdown", async (threat) =>
{
    await LogIncidentAsync(threat);
    await NotifySecurityTeamAsync(threat);
    await SecureShutdownAsync();
});

config.AddProtection(
    ProtectionModuleType.DebuggerDetection,
    ActionType.Custom,
    intervalMs: 30000,
    customActionName: "secure-shutdown"
);

Configuration

App runtime provides three configuration paths:

Deployment Options

SDK Integration

Install the NuGet package in your project. The agent lives inside your application binary. Wherever the application goes (a new server, a container, a different cloud region), the agent goes with it. You install once, and every deployment is protected automatically.

dotnet add package ByteHide.Monitor

dotnet add package ByteHide.Monitor

No code changes beyond adding the package. The agent initializes at startup, reads its configuration from the cloud dashboard, and begins protection.

Server-Side Deployment

Platform Support

Target Frameworks

• .NET Framework: 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8, 4.8.1
• .NET Core/5+: 3.1, 5.0, 6.0, 7.0, 8.0, 9.0
• .NET Standard: 2.0, 2.1 (for library projects)

Supported Platforms

• Desktop: Windows (x64, x86, ARM64), macOS (x64, ARM64), Linux (x64, ARM64)
• Mobile: Android (MAUI/Xamarin), iOS (MAUI/Xamarin)
• Web: ASP.NET Core, ASP.NET Framework, Blazor Server, Blazor WASM
• IoT: Raspberry Pi, embedded devices, edge computing

ByteHide Platform Integration

App runtime does not work in isolation. It feeds and improves every other layer of the ByteHide platform.

App runtime and Code

Code flags 200 vulnerabilities in your codebase. App runtime detects that one of them is being actively exploited in production. Code automatically reprioritizes it from medium to critical, because it is no longer theoretical. Conversely, App runtime confirms that an endpoint Code flagged is internal and unreachable from the outside. Code downgrades the priority. Your team fixes what matters first.

App runtime and Shield

Shield protects your code statically through obfuscation and virtualization. App runtime defends at runtime. When an attacker attempts to hook a method that Shield has virtualized, App runtime detects the hooking attempt, blocks it, and reports the full incident. Static fortification and runtime defense, working together.

App runtime and Audit

Every incident App runtime detects is recorded in Logs with full context: timestamp, detection type, payload, affected code, device fingerprint, confidence score, and response action taken. Cryptographically secured, immutable forensic evidence for compliance and audit.

Next Steps