利索-全球专利检索

  1. 登录
  2. 注册

搜索结果

132 条记录 (耗时 0.019 秒)

    Static analysis of validator routines
    31.
    发明授权
    Static analysis of validator routines 失效
    验证程序的静态分析

    公开(公告)号：US08726246B2

    公开(公告)日：2014-05-13

    申请号：US13109170

    申请日：2011-05-17

    申请人： Ryan Berg ,  Marco Pistoia ,  Takaaki Tateishi ,  Omer Tripp

    发明人： Ryan Berg ,  Marco Pistoia ,  Takaaki Tateishi ,  Omer Tripp

    IPC分类号： G06F9/44

    CPC分类号： G06F11/3612 ,  G06F8/436 ,  G06F11/3604

    摘要： A method includes accessing a validator routine having an input string and one or more return points, each return point returning a return value having two possible values; finding the return points in the validator routine; for each of the return points, performing a backwards traversal from a return point through a code section and determining constraints on the input string based at least on one or both of the two possible return values for the return point; using the determined constraints for the input string, determining whether all of the return values returned from the one or more return points meet validation constraints; and outputting one or more indications of whether all of the returned values returned from the return points meet the validation constraints for the one or both of the two possible return values. Apparatus and computer program products are also disclosed.

    摘要翻译： 一种方法包括访问具有输入字符串和一个或多个返回点的验证器程序，每个返回点返回具有两个可能值的返回值; 找到验证程序的返回点; 对于每个返回点，通过代码部分从返回点执行向后遍历，并且基于返回点的两个可能返回值中的至少一个或两个来确定对输入字符串的约束; 使用确定的输入字符串的约束，确定从一个或多个返回点返回的所有返回值是否满足验证约束; 并且输出一个或多个指示是否从返回点返回的所有返回值是否满足两个可能返回值中的一个或两个的验证约束。 还公开了装置和计算机程序产品。

    Verification of information-flow downgraders
    32.
    发明授权
    Verification of information-flow downgraders 失效
    验证信息流下载

    公开(公告)号：US08635602B2

    公开(公告)日：2014-01-21

    申请号：US12843308

    申请日：2010-07-26

    申请人： Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Takaaki Tateishi ,  Omer Tripp ,  Omri Weisman

    发明人： Yinnon Avraham Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Takaaki Tateishi ,  Omer Tripp ,  Omri Weisman

    IPC分类号： G06F9/44

    CPC分类号： G06F21/577 ,  H04L63/105

    摘要： A method includes determining grammar for output of an information-flow downgrader in a software program. The software program directs the output of the information-flow downgrader to a sink. The method includes determining whether the grammar of the output conforms to one or more predetermined specifications of the sink. The method includes, in response to a determination the grammar of the output conforms to the one or more predetermined specifications of the sink, determining the information-flow downgrader is verified for the sink, wherein determining grammar, determining whether the grammar, and determining the information-flow downgrader are performed via static analysis of the software program. Apparatus and computer program products are also disclosed. An apparatus includes a user interface providing a result of whether or not output of an information-flow downgrader in the software program conforms to one or more predetermined specifications of a sink in the software program.

    摘要翻译： 一种方法包括在软件程序中确定信息流降级器的输出的语法。 软件程序将信息流降级器的输出引导到宿。 该方法包括确定输出的语法是否符合汇的一个或多个预定规范。 该方法包括响应于确定，输出的语法符合信宿的一个或多个预定规范，确定信宿流降级器对于汇点进行验证，其中确定语法，确定语法，并确定 信息流降级器通过软件程序的静态分析来执行。 还公开了装置和计算机程序产品。 一种装置，包括提供软件程序中的信息流下载器的输出是否符合软件程序中的接收器的一个或多个预定规格的结果的用户界面。

    Identifying security vulnerability in computer software
    33.
    发明授权
    Identifying security vulnerability in computer software 有权
    识别计算机软件中的安全漏洞

    公开(公告)号：US08468605B2

    公开(公告)日：2013-06-18

    申请号：US12627351

    申请日：2009-11-30

    申请人： Yinnon A. Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Takaaki Tateishi ,  Omer Tripp ,  Omri Weisman

    发明人： Yinnon A. Haviv ,  Roee Hay ,  Marco Pistoia ,  Adi Sharabani ,  Takaaki Tateishi ,  Omer Tripp ,  Omri Weisman

    IPC分类号： G06F12/14 ,  G06F12/16 ,  G06F11/00 ,  G08B23/00 ,  G06F11/30 ,  G06F9/44

    CPC分类号： G06F21/566

    摘要： Identifying a security vulnerability in a computer software application by identifying at least one source in a computer software application, identifying at least one sink in the computer software application, identifying at least one input to any of the sinks, determining whether the input derives its value directly or indirectly from any of the sources, determining a set of possible values for the input, and identifying a security vulnerability where the set of possible values for the input does not match a predefined specification of legal values associated with the sink input.

    摘要翻译： 通过识别计算机软件应用中的至少一个源来识别计算机软件应用中的安全漏洞，识别计算机软件应用中的至少一个接收器，识别任何接收器的至少一个输入，确定输入是否导出其值 直接或间接地从任何来源确定输入的一组可能的值，以及识别安全漏洞，其中输入的可能值的集合不与预定义的与接收器输入相关联的合法值的规范相匹配。

    LABEL-BASED TAINT ANALYSIS
    34.
    发明申请
    LABEL-BASED TAINT ANALYSIS 失效
    基于标签的分析

    公开(公告)号：US20120210432A1

    公开(公告)日：2012-08-16

    申请号：US13028237

    申请日：2011-02-16

    申请人： Marco Pistoia ,  Takaaki Tateishi ,  Omer Tripp

    发明人： Marco Pistoia ,  Takaaki Tateishi ,  Omer Tripp

    IPC分类号： G06F11/00 ,  G06F9/44

    CPC分类号： G06F11/3604

    摘要： A computer-implemented method and apparatus, adapted to receive a computer program, and dynamically analyze the computer program to determine flow of untrusted data with respect to a computer resource associated with the computer program. Based on the flow of untrusted data, the method and apparatus determine an abstraction of the computerized resource, and performing static analysis of the computer program with respect to the abstraction, wherein the static analysis is for identifying whether the computer program is susceptible to one or more possible security vulnerabilities.

    摘要翻译： 一种计算机实现的方法和装置，适于接收计算机程序，并且动态分析所述计算机程序以确定相对于与所述计算机程序相关联的计算机资源的不受信任数据的流动。 基于不可信数据的流程，该方法和装置确定计算机化资源的抽象，并且针对抽象执行计算机程序的静态分析，其中静态分析用于识别计算机程序是否易受一个或多个 更多可能的安全漏洞。

    Global Variable Security Analysis
    35.
    发明申请
    Global Variable Security Analysis 失效
    全局变量安全分析

    公开(公告)号：US20120131670A1

    公开(公告)日：2012-05-24

    申请号：US12951435

    申请日：2010-11-22

    申请人： Shay Artzi ,  Ryan Berg ,  John Peyton ,  Marco Pistoia ,  Manu Sridharan ,  Takaaki Tateishi ,  Omer Tripp ,  Robert Wiener

    发明人： Shay Artzi ,  Ryan Berg ,  John Peyton ,  Marco Pistoia ,  Manu Sridharan ,  Takaaki Tateishi ,  Omer Tripp ,  Robert Wiener

    IPC分类号： G06F21/00

    CPC分类号： G06F21/577 ,  G06F21/00 ,  G06F2221/034

    摘要： A method includes determining selected global variables in a program for which flow of the selected global variables through the program is to be tracked. The selected global variables are less than all the global variables in the program. The method includes using a static analysis performed on the program, tracking flow through the program for the selected global variables. In response to one or more of the selected global variables being used in security-sensitive operations in the flow, use is analyzed of each one of the selected global variables in a corresponding security-sensitive operation. In response to a determination the use may be a potential security violation, the potential security violation is reported. Apparatus and computer program products are also disclosed.

    摘要翻译： 一种方法包括确定在所述程序中选择的全局变量，通过所述程序，所选择的全局变量的流程将被跟踪。 所选的全局变量小于程序中的所有全局变量。 该方法包括使用对程序执行的静态分析，跟踪所选择的全局变量的程序流程。 响应于在流中的安全敏感操作中使用的一个或多个所选择的全局变量，在相应的安全敏感操作中对所选择的全局变量中的每一个进行分析。 为了回应确定，使用可能是潜在的安全违规，报告潜在的安全违规。 还公开了装置和计算机程序产品。

    ANOMALY DETECTION AT THE LEVEL OF RUN TIME DATA STRUCTURES
    39.
    发明申请
    ANOMALY DETECTION AT THE LEVEL OF RUN TIME DATA STRUCTURES 审中-公开

    公开(公告)号：US20140053029A1

    公开(公告)日：2014-02-20

    申请号：US13614671

    申请日：2012-09-13

    申请人： Marco Pistoia ,  Omer Tripp

    发明人： Marco Pistoia ,  Omer Tripp

    IPC分类号： G06F11/07

    CPC分类号： G06F11/0751

    摘要： A useful embodiment of the invention is directed to a method associated with a computer program comprising one or more basic blocks, wherein the program defines and uses multiple data structures, such as the list of all customers of a bank along with their account information. The method includes identifying one or more invariants, wherein each invariant is associated with one of the data structures. The method further includes determining at specified times whether an invariant has been violated. Responsive to detecting a violation of one of the invariants, the detected violation is flagged as an anomaly.