专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

11. 发明授权

US08925094B2 Automatic synthesis of unit tests for security testing 有权
公开(公告)号：US08925094B2
公开(公告)日：2014-12-30
申请号：US13563376
申请日：2012-07-31
申请人： Daniel Kalman , Ory Segal , Omer Tripp , Omri Weisman
发明人： Daniel Kalman , Ory Segal , Omer Tripp , Omri Weisman
IPC分类号： H04L29/06 , G06F21/00 , G06F21/57 , G06F21/10
CPC分类号： G06F21/577 , G06F21/10 , G06F2221/034 , H04L63/1433
摘要： Performing security analysis on a computer program under test (CPUT). The CPUT can be analyzed to identify data pertinent to potential security vulnerabilities of the CPUT. At least a first unit test configured to test a particular unit of program code within the CPUT can be automatically synthesized. The first unit test can be configured to initialize at least one parameter used by the particular unit of program code within the CPUT, and can be provided at least a first test payload configured to exploit at least one potential security vulnerability of the CPUT. The first unit test can be dynamically processed to communicate the first test payload to the particular unit of program code within the CPUT. Whether the first test payload exploits an actual security vulnerability of the CPUT can be determined, and a security analysis report can be output.

12. 发明申请

US20130081003A1 SELECTIVE DATA FLOW ANALYSIS OF BOUNDED REGIONS OF COMPUTER SOFTWARE APPLICATIONS 有权
标题翻译：选择性数据流分析计算机软件应用的边界区域
公开(公告)号：US20130081003A1
公开(公告)日：2013-03-28
申请号：US13411771
申请日：2012-03-05
申请人： DANIEL KALMAN , Dmitri Pikus , Omer Tripp , Omei Weisman
发明人： DANIEL KALMAN , Dmitri Pikus , Omer Tripp , Omei Weisman
IPC分类号： G06F9/44
CPC分类号： G06F21/52 , G06F8/51 , G06F8/75 , G06F11/3604
摘要： Performing data flow analysis of a computer software application, including, for a data flow analysis type, identifying within a computer software application code base a plurality of seeds relating to the data flow analysis type, for each of the plurality of seeds, defining a portion of the computer software application code base to a predefined depth of calls backward from the seed and to a predefined depth of calls forward from the seed, thereby resulting in a plurality of bounded portions of the computer software application code base, detecting a change in the computer software application code base, and performing, on any of the bounded portions affected by the change, a data flow analysis relating to the data flow analysis type.
摘要翻译：执行计算机软件应用的数据流分析，包括对于数据流分析类型，在计算机软件应用程序代码库内识别与数据流分析类型相关的多个种子，为多个种子中的每一个定义一部分的计算机软件应用程序代码库的预定深度从种子返回到预定义的深度，并且从种子转发到预定义的呼叫深度，从而导致计算机软件应用程序代码库的多个有界部分，计算机软件应用程序代码库，并在受变更影响的任何有界部分执行与数据流分析类型相关的数据流分析。

13. 发明授权

US08584246B2 Eliminating false reports of security vulnerabilities when testing computer software 失效
标题翻译：在测试计算机软件时，消除安全漏洞的虚假报告
公开(公告)号：US08584246B2
公开(公告)日：2013-11-12
申请号：US12578013
申请日：2009-10-13
申请人： Yinnon Avraham Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon Avraham Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F12/14
CPC分类号： G06F21/57 , G06F11/3692
摘要： A system for eliminating false reports of security vulnerabilities when testing computer software, including a taint analysis engine configured to identify a tainted variable v in a computer application, a data mapping identification engine configured to identify a variable x within the application that holds data derived from v, where x is in a different format than v, an AddData identification engine configured to identify an AddData operation within the application that is performed on x, a signature identification engine configured to identify a Sign operation within the application that is performed on the results of the AddData operation on x, a signature comparison identification engine configured to identify an operation within the application that compares the results of the Sign operation with another value.
摘要翻译：一种用于在测试计算机软件时消除安全漏洞的虚假报告的系统，包括配置成识别计算机应用程序中的受污染变量v的污染分析引擎，配置为识别应用程序内的变量x，该变量x保存从 v，其中x与v不同的格式，被配置为识别在x上执行的应用程序内的AddData操作的AddData识别引擎，被配置为识别在结果上执行的应用程序内的签名操作的签名识别引擎的签名比较识别引擎，所述签名比较识别引擎被配置为识别应用程序内将所述Sign操作的结果与另一值进行比较的操作。

14. 发明授权

US08533694B2 Identification of read/write chains during static analysis of computer software 有权
标题翻译：在计算机软件的静态分析期间识别读/写链
公开(公告)号：US08533694B2
公开(公告)日：2013-09-10
申请号：US12129894
申请日：2008-05-30
申请人： Marco Pistoia , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Marco Pistoia , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F9/45 , G06F7/00 , G06F17/30
CPC分类号： G06F8/433
摘要： A system for identifying read/write chains in computer software, including a static analysis engine identifying within computer software logical container accesses, a string analyzer configured to at least partly resolve any variables identifying the logical container in any of the accesses by determining a set of potential values of any of the variables, and a Logical Container Access Virtualization component (LCAV) configured to identify the type and scope of any permutations of the accesses, where each of the permutations is defined by substituting any of the potential values for any of the access variables, and identify any read/write chains within the computer software by matching any of the access permutations that read from the logical container with any of the access permutations that write to the logical container if there is an intersection between the scopes of the read and write access permutations.
摘要翻译：一种用于识别计算机软件中的读/写链的系统，包括在计算机软件逻辑容器访问内识别的静态分析引擎，串行分析器，其被配置为至少部分地解析任何访问中识别逻辑容器的任何变量，任何变量的潜在值和逻辑容器访问虚拟化组件（LCAV），其被配置为识别访问的任何排列的类型和范围，其中每个排列通过将任何潜在值替换为任何访问变量，并通过将从逻辑容器读取的任何访问排列与写入逻辑容器的任何访问排列进行匹配，以识别计算机软件中的任何读/写链，如果读取范围之间存在交集并写入访问排列。

15. 发明授权

US08528095B2 Injection context based static analysis of computer software applications 有权
标题翻译：基于注入场景的静态分析计算机软件应用
公开(公告)号：US08528095B2
公开(公告)日：2013-09-03
申请号：US12825293
申请日：2010-06-28
申请人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F11/00 , H04L9/32 , G06F15/173 , G06F9/44
CPC分类号： G06F11/3604 , G06F8/75 , G06F21/577
摘要： Embodiments of the invention generally relate to injection context based static analysis of computer software applications. Embodiments of the invention may include selecting a sink within a computer software application, tracing a character output stream leading to the sink within the computer software application, determining an injection context of the character output stream at the sink, where the injection context is predefined in association with a state of the character output stream at the sink, identifying any actions that have been predefined in association with the identified injection context, and providing a report of the actions.
摘要翻译：本发明的实施例一般涉及计算机软件应用的基于注入上下文的静态分析。本发明的实施例可以包括选择计算机软件应用程序内的汇点，跟踪通向计算机软件应用程序内的汇点的字符输出流，确定汇点处的字符输出流的注入上下文，其中注入上下文在与汇点处的字符输出流的状态相关联，识别已经与所识别的注入上下文相关联地预定义的任何动作，以及提供动作的报告。

16. 发明授权

US08726245B2 Static analysis of computer software applications having a model-view-controller architecture 失效
标题翻译：具有模型视图 - 控制器架构的计算机软件应用程序的静态分析
公开(公告)号：US08726245B2
公开(公告)日：2014-05-13
申请号：US13016364
申请日：2011-01-28
申请人： Yinnon A. Haviv , Omer Tripp , Omri Weisman
发明人： Yinnon A. Haviv , Omer Tripp , Omri Weisman
IPC分类号： G06F9/44 , G06F9/45
CPC分类号： G06F8/20 , G06F8/75
摘要： Preparing a computer software application for static analysis by identifying a control flow within a model portion of a computer software application having a model-view-controller architecture, where the control flow passes a value to a controller portion of the computer software application, analyzing a declarative specification of the controller portion of the computer software application to identify a view to which the controller portion passes control based on the value, and synthesizing a method within the computer software application, where the method calls the view.
摘要翻译：通过识别具有模型 - 视图 - 控制器架构的计算机软件应用的模型部分内的控制流来准备用于静态分析的计算机软件应用，其中控制流将值传递给计算机软件应用的控制器部分，分析计算机软件应用程序的控制器部分的声明性规范，以识别控制器部分基于该值传递控制的视图，以及在方法调用该视图的情况下合成计算机软件应用程序内的方法。

17. 发明授权

US08387017B2 Black box testing optimization using information from white box testing 失效
标题翻译：黑箱测试优化使用白盒测试中的信息
公开(公告)号：US08387017B2
公开(公告)日：2013-02-26
申请号：US12553417
申请日：2009-09-03
申请人： Rob Calendino , Craig Robert Earl Conboy , Guy Podjarny , Ory Segal , Adi Sharabani , Omer Tripp , Omri Weisman
发明人： Rob Calendino , Craig Robert Earl Conboy , Guy Podjarny , Ory Segal , Adi Sharabani , Omer Tripp , Omri Weisman
IPC分类号： G06F9/44 , G06F9/45 , G06F9/00
CPC分类号： G06F11/3672
摘要： Testing a computer software application by identifying a sink in the computer software application, identifying a source associated with the sink in the application, identifying an entry point associated with the source in the application, where the source is configured to receive input provided externally to the application via the entry point, determining a sink type represented by the sink, and providing to a testing application information identifying the entry point and in association with the sink type.
摘要翻译：通过识别计算机软件应用程序中的接收器来测试计算机软件应用程序，识别与应用程序中的接收器相关联的源，识别与应用程序中的源相关联的入口点，其中源被配置为接收从外部提供的输入通过入口点应用，确定由汇点表示的汇点类型，以及向测试应用程序提供标识入口点并与汇点类型相关联的信息。

18. 发明申请

US20120254839A1 SIMULATING BLACK BOX TEST RESULTS USING INFORMATION FROM WHITE BOX TESTING 有权
标题翻译：使用白盒测试中的信息模拟黑盒测试结果
公开(公告)号：US20120254839A1
公开(公告)日：2012-10-04
申请号：US13493067
申请日：2012-06-11
申请人： Stephen Fink , Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Manu Sridharan , Frank Tip , Omer Tripp , Omri Weisman
发明人： Stephen Fink , Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Manu Sridharan , Frank Tip , Omer Tripp , Omri Weisman
IPC分类号： G06F9/44
CPC分类号： G06F11/3604 , G06F9/44589 , G06F9/455 , G06F11/36 , G06F11/362 , G06F21/577 , G06F2221/033
摘要： Systems, methods are program products for simulating black box test results using information obtained from white box testing, including analyzing computer software (e.g., an application) to identify a potential vulnerability within the computer software application and a plurality of milestones associated with the potential vulnerability, where each of the milestones indicates a location within the computer software application, tracing a path from a first one of the milestones to an entry point into the computer software application, identifying an input to the entry point that would result in a control flow from the entry point and through each of the milestones, describing the potential vulnerability in a description indicating the entry point and the input, and presenting the description via a computer-controlled output medium.
摘要翻译：系统，方法是使用从白盒测试获得的信息来模拟黑盒测试结果的程序产品，包括分析计算机软件（例如应用程序）以识别计算机软件应用程序中的潜在漏洞以及与潜在漏洞相关联的多个里程碑，其中每个里程碑指示计算机软件应用程序内的位置，跟踪从第一个里程碑到入口点的路径到计算机软件应用程序中，识别入口点的输入将导致控制流从描述在描述入口点和输入的描述中的潜在漏洞，以及经由计算机控制的输出介质呈现描述的入口点和通过每个里程碑。

19. 发明申请

US20110302566A1 FIXING SECURITY VULNERABILITY IN A SOURCE CODE 有权
标题翻译：在源代码中固定安全漏洞
公开(公告)号：US20110302566A1
公开(公告)日：2011-12-08
申请号：US12792747
申请日：2010-06-03
申请人： Aharon Abadi , Yishai A. Feldman , Ran Ettinger , Jonathan Bnayahu , Omer Tripp , Yinnon Haviv , Adi Sharabani , Omri Weisman
发明人： Aharon Abadi , Yishai A. Feldman , Ran Ettinger , Jonathan Bnayahu , Omer Tripp , Yinnon Haviv , Adi Sharabani , Omri Weisman
IPC分类号： G06F9/44
CPC分类号： G06F21/577 , G06F8/72 , G06F21/12 , G06F21/121 , G06F21/125 , G06F21/563
摘要： A computer implemented method for automatically fixing a security vulnerability in a source code is disclosed. The method includes obtaining identification of code that sends tainted data to corresponding sink code in the source code; and automatically fixing the vulnerability by automatically performing code modification which is selected from the group of code modifications consisting of: code motion and code duplication. Also disclosed are computer program product and data processing system.
摘要翻译：公开了一种用于自动修复源代码中的安全漏洞的计算机实现方法。该方法包括获取将污染数据发送到源代码中的相应宿码的代码的识别; 并通过自动执行代码修改来自动修复该漏洞，该代码修改从代码运动和代码复制组成的代码修改组中选择。还公开了计算机程序产品和数据处理系统。

20. 发明申请

US20110055813A1 Black Box Testing Optimization Using Information from White Box Testing 失效
标题翻译：黑盒测试优化使用白盒测试中的信息
公开(公告)号：US20110055813A1
公开(公告)日：2011-03-03
申请号：US12553417
申请日：2009-09-03
申请人： Rob Calendino , Craig Robert Earl Conboy , Guy Podjarny , Ory Segal , Adi Sharabani , Omer Tripp , Omri Weisman
发明人： Rob Calendino , Craig Robert Earl Conboy , Guy Podjarny , Ory Segal , Adi Sharabani , Omer Tripp , Omri Weisman
IPC分类号： G06F9/44
CPC分类号： G06F11/3672
摘要： Testing a computer software application by identifying a sink in the computer software application, identifying a source associated with the sink in the application, identifying an entry point associated with the source in the application, where the source is configured to receive input provided externally to the application via the entry point, determining a sink type represented by the sink, and providing to a testing application information identifying the entry point and in association with the sink type.
摘要翻译：通过识别计算机软件应用程序中的接收器来测试计算机软件应用程序，识别与应用程序中的接收器相关联的源，识别与应用程序中的源相关联的入口点，其中源被配置为接收从外部提供的输入通过入口点应用，确定由汇点表示的汇点类型，以及向测试应用程序提供标识入口点并与汇点类型相关联的信息。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式