Patent application number | Description | Published |
20110088023 | SYSTEM AND METHOD FOR STATIC DETECTION AND CATEGORIZATION OF INFORMATION-FLOW DOWNGRADERS - A system and method for static detection and categorization of information-flow downgraders includes transforming a program stored in a memory device by statically analyzing program variables to yield a single assignment to each variable in an instruction set. The instruction set is translated to production rules with string operations. A context-free grammar is generated from the production rules to identify a finite set of strings. An information-flow downgrader function is identified by checking the finite set of strings against one or more function specifications. | 04-14-2011 |
20130007885 | BLACK-BOX TESTING OF WEB APPLICATIONS WITH CLIENT-SIDE CODE EVALUATION - Detecting security vulnerabilities in web applications by interacting with a web application at a computer server during its execution at the computer server, identifying client-side instructions provided by the web application responsive to an interaction with the web application, where the client-side instructions are configured to be implemented by a client computer that receives the client-side instructions from the computer server, evaluating the identified client-side instructions, and identifying a security vulnerability associated with the client-side instructions. | 01-03-2013 |
20130007887 | BLACK-BOX TESTING OF WEB APPLICATIONS WITH CLIENT-SIDE CODE EVALUATION - Detecting security vulnerabilities in web applications by interacting with a web application at a computer server during its execution at the computer server, identifying client-side instructions provided by the web application responsive to an interaction with the web application, where the client-side instructions are configured to be implemented by a client computer that receives the client-side instructions from the computer server, evaluating the identified client-side instructions, and identifying a security vulnerability associated with the client-side instructions. | 01-03-2013 |
20130111449 | STATIC ANALYSIS WITH INPUT REDUCTION | 05-02-2013 |
20130111594 | DETECTION OF DOM-BASED CROSS-SITE SCRIPTING VULNERABILITIES | 05-02-2013 |
20130111595 | DETECTION OF DOM-BASED CROSS-SITE SCRIPTING VULNERABILITIES | 05-02-2013 |
20130205398 | AUTOMATIC SYNTHESIS OF UNIT TESTS FOR SECURITY TESTING - Performing security analysis on a computer program under test (CPUT). The CPUT can be analyzed to identify data pertinent to potential security vulnerabilities of the CPUT. At least a first unit test configured to test a particular unit of program code within the CPUT can be automatically synthesized. The first unit test can be configured to initialize at least one parameter used by the particular unit of program code within the CPUT, and can be provided at least a first test payload configured to exploit at least one potential security vulnerability of the CPUT. The first unit test can be dynamically processed to communicate the first test payload to the particular unit of program code within the CPUT. Whether the first test payload exploits an actual security vulnerability of the CPUT can be determined, and a security analysis report can be output. | 08-08-2013 |
20130205399 | AUTOMATIC SYNTHESIS OF UNIT TESTS FOR SECURITY TESTING - Performing security analysis on a computer program under test (CPUT). The CPUT can be analyzed to identify data pertinent to potential security vulnerabilities of the CPUT. At least a first unit test configured to test a particular unit of program code within the CPUT can be automatically synthesized. The first unit test can be configured to initialize at least one parameter used by the particular unit of program code within the CPUT, and can be provided at least a first test payload configured to exploit at least one potential security vulnerability of the CPUT. The first unit test can be dynamically processed to communicate the first test payload to the particular unit of program code within the CPUT. Whether the first test payload exploits an actual security vulnerability of the CPUT can be determined, and a security analysis report can be output. | 08-08-2013 |
20140310812 | IDENTIFYING SECURITY VULNERABILITIES RELATED TO INTER-PROCESS COMMUNICATIONS - Identifying security vulnerabilities related to inter-process communications by identifying within the instructions of a computer software application an object creation location configured to create an inter-process communications object, identifying within the instructions of the computer software application a location of an inter-process communications method, determining whether a path exists for an inter-process communications object created at the object creation location to propagate to the inter-process communications method, classifying with a classification selected from a plurality of predefined classifications, any of the inter-process communications object, the object creation location, and the location of the inter-process communications method, and reporting as a security vulnerability the classified inter-process communications object, object creation location, or location of the inter-process communications method if the path exists and if the classification is predefined to indicate that reporting is warranted. | 10-16-2014 |
20140310814 | IDENTIFYING SECURITY VULNERABILITIES RELATED TO INTER-PROCESS COMMUNICATIONS - Identifying security vulnerabilities related to inter-process communications by identifying within the instructions of a computer software application an object creation location configured to create an inter-process communications object, identifying within the instructions of the computer software application a location of an inter-process communications method, determining whether a path exists for an inter-process communications object created at the object creation location to propagate to the inter-process communications method, classifying with a classification selected from a plurality of predefined classifications, any of the inter-process communications object, the object creation location, and the location of the inter-process communications method, and reporting as a security vulnerability the classified inter-process communications object, object creation location, or location of the inter-process communications method if the path exists and if the classification is predefined to indicate that reporting is warranted. | 10-16-2014 |