公开(公告)号：US20120054552A1

公开(公告)日：2012-03-01

申请号：US12873816

申请日：2010-09-01

申请人： Shay Artzi ,  Julian Dolby ,  Marco Pistoia ,  Frank Tip

发明人： Shay Artzi ,  Julian Dolby ,  Marco Pistoia ,  Frank Tip

IPC分类号： G06F11/36

CPC分类号： G06F11/3684 ,  G06F11/3688

摘要： Disclosed is a novel computer implemented system, on demand service, computer program product and a method for fault-localization techniques that apply statistical analyses to execution data gathered from multiple tests. The present invention determines the fault-localization effectiveness of test suites generated according to several test-generation techniques based on combined concrete and symbolic (concolic) execution. These techniques are evaluated by applying the Ochiai fault-localization technique to generated test suites in order to localize 35 faults in four PHPWeb applications. The results show that the test-generation techniques under consideration produce test suites with similar high fault-localization effectiveness, when given a large time budget.

摘要翻译： 公开了一种新颖的计算机实现系统，按需服务，计算机程序产品和用于故障定位技术的方法，其将统计分析应用于从多个测试收集的执行数据。 本发明确定了基于组合的具体和符号（concolic）执行的几种测试生成技术产生的测试套件的故障定位有效性。 通过将Ochiai故障定位技术应用于生成的测试套件来评估这些技术，以便在四个PHPWeb应用程序中定位35个故障。 结果表明，考虑到的测试生成技术产生具有类似高故障定位效果的测试套件，当给予大的时间预算时。

公开(公告)号：US20120151454A1

公开(公告)日：2012-06-14

申请号：US12966556

申请日：2010-12-13

申请人： Shay ARTZI ,  Julian Dolby ,  Marco Pistoia ,  Frank Tip

发明人： Shay ARTZI ,  Julian Dolby ,  Marco Pistoia ,  Frank Tip

IPC分类号： G06F9/44

CPC分类号： G06F11/3684 ,  H04L69/40

摘要： The present invention provides a system, computer program product, and a computer implemented method for analyzing a set of two or more communicating applications. The method begins with receiving a first second application that communicates with each other during execution. Next, an initial input for executing the first application and the second application is received. The initial input is added to a set of inputs. An iterative execution loop is performed at least once. The loop begins with selecting inputs out of the set of inputs for execution. Next, using the selected inputs, the first and/or the second application is executed while information regarding the execution and information communicated to the other application are recorded. A set of one or more new application inputs for either applications is generated based the second application recorded information and the first application information. These new inputs are added to the set of inputs.

摘要翻译： 本发明提供了一种系统，计算机程序产品和用于分析一组两个或多个通信应用的计算机实现的方法。 该方法开始于在执行期间接收彼此通信的第一个第二应用程序。 接下来，接收用于执行第一应用和第二应用的初始输入。 初始输入被添加到一组输入。 执行迭代执行循环至少一次。 循环从选择输入集合中的输入开始执行。 接下来，使用所选择的输入，执行第一和/或第二应用，同时记录关于执行的信息和传送给其他应用的信息。 基于第二应用记录信息和第一应用信息生成用于任一应用的一组或多个新的应用输入。 这些新的输入被添加到该组输入。

公开(公告)号：US20120054553A1

公开(公告)日：2012-03-01

申请号：US12873843

申请日：2010-09-01

申请人： Shay ARTZI ,  Julian Dolby ,  Marco Pistoia ,  Frank Tip

发明人： Shay ARTZI ,  Julian Dolby ,  Marco Pistoia ,  Frank Tip

IPC分类号： G06F11/36

CPC分类号： G06F11/3688 ,  G06F11/3692

摘要： Disclosed is a novel computer implemented system, on demand service, computer program product and a method that leverages combined concrete and symbolic execution and several fault-localization techniques to create a uniquely powerful tool that automatically detects failures and localizes faults in PHP Web applications. The fault-localization techniques evaluated combine variations on the Tarantula algorithm with a technique based on maintaining a mapping between executed statements and the fragments of output they produce, mapping of conditional results, and values returned from function calls. These techniques have been implemented in a tool called Apollo, and evaluated by localizing 75 randomly selected faults that were exposed by automatically generated tests in four PHP applications. Our findings indicate that, using our best technique, 87.7% of the faults under consideration are localized to within 1% of all executed statements, which constitutes an almost five-fold improvement over the Tarantula algorithm.

摘要翻译： 公开了一种新颖的计算机实现系统，按需服务，计算机程序产品和利用组合的具体和符号执行以及多种故障定位技术的方法来创建一个独特强大的工具，可自动检测故障并定位PHP Web应用程序中的故障。 评估的故障定位技术将Tarantula算法的变化与基于维护执行语句之间的映射及其产生的输出片段，条件结果映射以及函数调用返回值的技术相结合。 这些技术已经在一个名为Apollo的工具中实现，并通过将四个PHP应用程序中自动生成的测试暴露的75个随机选择的故障进行本地化评估。 我们的研究结果表明，使用我们最好的技术，所考虑的故障的87.7％被定位在所有执行语句的1％内，这比Tarantula算法提高了近5倍。

公开(公告)号：US09043761B2

公开(公告)日：2015-05-26

申请号：US12873843

申请日：2010-09-01

申请人： Shay Artzi ,  Julian Dolby ,  Marco Pistoia ,  Frank Tip

发明人： Shay Artzi ,  Julian Dolby ,  Marco Pistoia ,  Frank Tip

IPC分类号： G06F9/44 ,  G06F11/36

CPC分类号： G06F11/3688 ,  G06F11/3692

摘要： Disclosed is a novel computer implemented system, on demand service, computer program product and a method that leverages combined concrete and symbolic execution and several fault-localization techniques to automatically detects failures and localizes faults in PHP Hypertext Preprocessor (“PHP”) Web applications.

摘要翻译： 公开了一种新颖的计算机实现系统，按需服务，计算机程序产品和利用组合的具体和符号执行以及多种故障定位技术来自动检测PHP超文本预处理器（“PHP”）Web应用程序中的故障和本地化故障的方法。

公开(公告)号：US08387018B2

公开(公告)日：2013-02-26

申请号：US12873816

申请日：2010-09-01

申请人： Shay Artzi ,  Julian Dolby ,  Marco Pistoia ,  Frank Tip

发明人： Shay Artzi ,  Julian Dolby ,  Marco Pistoia ,  Frank Tip

IPC分类号： G06F9/44 ,  G06F11/00

CPC分类号： G06F11/3684 ,  G06F11/3688

摘要： Disclosed is a novel computer implemented system, on demand service, computer program product and a method for fault-localization techniques that apply statistical analyses to execution data gathered from multiple tests. The present invention determines the fault-localization effectiveness of test suites generated according to several test-generation techniques based on combined concrete and symbolic (concolic) execution. These techniques are evaluated by applying the Ochiai fault-localization technique to generated test suites in order to localize 35 faults in four PHPWeb applications. The results show that the test-generation techniques under consideration produce test suites with similar high fault-localization effectiveness, when given a large time budget.

摘要翻译： 公开了一种新颖的计算机实现系统，按需服务，计算机程序产品和用于故障定位技术的方法，其将统计分析应用于从多个测试收集的执行数据。 本发明确定了基于组合的具体和符号（concolic）执行的几种测试生成技术产生的测试套件的故障定位有效性。 通过将Ochiai故障定位技术应用于生成的测试套件来评估这些技术，以便在四个PHPWeb应用程序中定位35个故障。 结果表明，考虑到的测试生成技术产生具有类似高故障定位效果的测试套件，当给予大的时间预算时。

公开(公告)号：US08914890B2

公开(公告)日：2014-12-16

申请号：US13018342

申请日：2011-01-31

申请人： Marco Pistoia ,  Ori Segal ,  Omer Tripp

发明人： Marco Pistoia ,  Ori Segal ,  Omer Tripp

IPC分类号： G06F11/00 ,  H04L29/06 ,  G06F21/57 ,  G06F21/56

CPC分类号： G06F21/563 ,  G06F21/577 ,  H04L63/1433

摘要： Determining the vulnerability of computer software applications to privilege-escalation attacks, such as where an instruction classifier is configured to be used for identifying a candidate access-restricted area of the instructions of a computer software application, and a static analyzer is configured to statically analyze the candidate access-restricted area to determine if there is a conditional instruction that controls execution flow into the candidate access-restricted area, perform static analysis to determine if the conditional instruction is dependent on a data source within the computer software application, and designate the candidate access-restricted area as vulnerable to privilege-escalation attacks absent either of the conditional instruction and the date source.

公开(公告)号：US20140075561A1

公开(公告)日：2014-03-13

申请号：US13611201

申请日：2012-09-12

申请人： Salvatore A. Guarnieri ,  Marco Pistoia ,  Omer Tripp

发明人： Salvatore A. Guarnieri ,  Marco Pistoia ,  Omer Tripp

IPC分类号： G06F21/00

CPC分类号： G06F21/577 ,  G06F17/211 ,  G06F17/2211 ,  G06F17/27 ,  G06F17/272 ,  G06F17/2765 ,  G06F21/552 ,  G06F21/554 ,  G06F21/563 ,  H04L63/1408 ,  H04L63/1433 ,  H04L63/168

摘要： Methods for creating a hybrid string representations include receiving string information as input; parsing the string information to produce one or more string components; determining string components that may be represented concretely by comparing the one or more components to a set of known concretizations; abstracting all string components that could not be represented concretely; and creating a hybrid string representation that includes at least one concrete string component and at least one abstracted string component.

摘要翻译： 用于创建混合字符串表示的方法包括接收字符串信息作为输入; 解析字符串信息以产生一个或多个字符串组件; 确定可以通过将一个或多个组件与一组已知具体化进行比较来具体表示的字符串组件; 抽象出不能具体表现的所有字符串组件; 以及创建包括至少一个具体字符串组件和至少一个抽象字符串组件的混合字符串表示。

公开(公告)号：US20140053029A1

公开(公告)日：2014-02-20

申请号：US13614671

申请日：2012-09-13

申请人： Marco Pistoia ,  Omer Tripp

发明人： Marco Pistoia ,  Omer Tripp

IPC分类号： G06F11/07

CPC分类号： G06F11/0751

摘要： A useful embodiment of the invention is directed to a method associated with a computer program comprising one or more basic blocks, wherein the program defines and uses multiple data structures, such as the list of all customers of a bank along with their account information. The method includes identifying one or more invariants, wherein each invariant is associated with one of the data structures. The method further includes determining at specified times whether an invariant has been violated. Responsive to detecting a violation of one of the invariants, the detected violation is flagged as an anomaly.

公开(公告)号：US08544104B2

公开(公告)日：2013-09-24

申请号：US12776465

申请日：2010-05-10

申请人： Michael George Burke ,  Igor Peshansky ,  Marco Pistoia ,  Omer Tripp

发明人： Michael George Burke ,  Igor Peshansky ,  Marco Pistoia ,  Omer Tripp

IPC分类号： G06F21/00

CPC分类号： G06F21/60 ,  G06F19/00 ,  G06F21/6245 ,  G16H10/60

摘要： A computer-readable medium is disclosed that tangibly embodies a program of machine-readable instructions executable by a digital processing apparatus to perform operations including determining whether data to be released from a database is associated with one or more confidential mappings between sets of data in the database. The operations also include, in response to the data being associated with the one or more confidential mappings, determining whether release of the data meets one or more predetermined anonymity requirements of an anonymity policy. Methods and apparatus are also disclosed.

公开(公告)号：US20120216177A1

公开(公告)日：2012-08-23

申请号：US13033024

申请日：2011-02-23

申请人： Stephen Fink ,  Yinnon A. Haviv ,  Marco Pistoia ,  Omer Tripp ,  Omri Weisman

发明人： Stephen Fink ,  Yinnon A. Haviv ,  Marco Pistoia ,  Omer Tripp ,  Omri Weisman

IPC分类号： G06F9/44

CPC分类号： G06F8/75 ,  G06F8/77

摘要： A method is disclosed that includes, using a static analysis, analyzing a software program to determine a number of paths from sources accepting information to sinks using that information or a modified version of that information and to determine multiple paths from the number of paths. The determined multiple paths have a same transition from an application portion of the software program to a library portion of the software program and require a same downgrading action to address a vulnerability associated with source-sink pairs in the multiple paths. The analyzing includes determining the multiple paths using a path-sensitive analysis. The method includes, for the determined multiple paths, grouping the determined multiple paths into a single representative indication of the determined multiple paths. The method includes outputting the single representative indication. Computer program products and apparatus are also disclosed.

摘要翻译： 公开了一种方法，其包括使用静态分析来分析软件程序以使用该信息或该信息的修改版本从接收信息的信源到汇点确定多个路径，并且从路径数确定多条路径。 所确定的多个路径具有从软件程序的应用部分到软件程序的库部分的相同转换，并且需要相同的降级动作来解决与多个路径中的源 - 汇对相关联的漏洞。 分析包括使用路径敏感分析来确定多个路径。 该方法包括对于所确定的多个路径，将所确定的多个路径分组成所确定的多个路径的单个代表性指示。 该方法包括输出单个代表性指示。 还公开了计算机程序产品和装置。