专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US10586049B2 Detection of second order vulnerabilities in web services 有权
公开(公告)号：US10586049B2
公开(公告)日：2020-03-10
申请号：US13335439
申请日：2011-12-22
申请人： Yair Amit , Evgeny Beskrovny , Omer Tripp
发明人： Yair Amit , Evgeny Beskrovny , Omer Tripp
IPC分类号： H04L29/06 , G06F21/57 , H04L29/08 , G06F9/30 , G07B17/00 , H04W12/00
摘要： A system for detecting a vulnerability in a Web service can include a processor configured to initiate executable operations including determining whether a Web service uses identity of a requester to select one of a plurality of different paths of a branch in program code of the Web service and, responsive to determining that the Web service does select one of a plurality of different paths of a branch according to identity of the requester, indicating that the Web service has a potential vulnerability.

2. 发明授权

US09460282B2 Static security analysis using a hybrid representation of string values 有权
标题翻译：使用字符串值的混合表示形式的静态安全性分析
公开(公告)号：US09460282B2
公开(公告)日：2016-10-04
申请号：US13611792
申请日：2012-09-12
申请人： Salvatore A. Guarnieri , Marco Pistoia , Omer Tripp
发明人： Salvatore A. Guarnieri , Marco Pistoia , Omer Tripp
IPC分类号： G06F17/27 , G06F21/55 , H04L29/06
CPC分类号： G06F21/577 , G06F17/211 , G06F17/2211 , G06F17/27 , G06F17/272 , G06F17/2765 , G06F21/552 , G06F21/554 , G06F21/563 , H04L63/1408 , H04L63/1433 , H04L63/168
摘要： Systems for constructing hybrid string representations include a string parser configured to parse received string information to produce one or more string components, a database configured to store a set of known concretizations, and a processor configured to compare the one or more string components to the set of known concretizations to determine string components that may be represented concretely, to abstract all string components that could not be represented concretely, and to create a hybrid string representation that includes at least one concrete string component and at least one abstracted string component.
摘要翻译：用于构建混合字符串表示的系统包括：字符串解析器，被配置为解析接收到的字符串信息以产生一个或多个字符串组件;配置为存储一组已知具体化的数据库;以及处理器，被配置为将一个或多个字符串组件与组已知的具体化以确定可能具体表示的字符串组件，以抽象出不能具体表示的所有字符串组件，并创建包含至少一个具体字符串组件和至少一个抽象字符串组件的混合字符串表示。

3. 发明申请

US20150089637A1 System, Method and Apparatus for Simultaneous Definition and Enforcement of Access-control and Integrity Policies 审中-公开
标题翻译：用于同时定义和执行访问控制和完整性政策的系统，方法和装置
公开(公告)号：US20150089637A1
公开(公告)日：2015-03-26
申请号：US14033502
申请日：2013-09-22
申请人： Paolina Centonze , Yinnon Avraham Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Omer Tripp
发明人： Paolina Centonze , Yinnon Avraham Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Omer Tripp
IPC分类号： G06F21/57
CPC分类号： G06F21/57 , G06F21/51 , G06F21/604 , H04L63/102 , H04L63/20
摘要： Access-control and information-flow integrity policies are enforced in a computing system by detecting security-sensitive sinks in software code for an application running on the computing system and retrieving an access-control policy from a database accessible to the computing system. The access-control policy maps a set of access permissions within the computing system to each one of a plurality of principals. For each detected security-sensitive sink, all principals that influence that security-sensitive sink are detected and an overall access permission is assigned to each security-sensitive sink by taking the intersection of the access permission sets for all influencing principals of that security-sensitive sink. If this permission set is inadequate, an integrity violation is reported. In addition, permission labels are assigned to each value of variables used in the security-sensitive sinks. Each permission label is a set of permissions.
摘要翻译：访问控制和信息流完整性策略在计算系统中通过检测在计算系统上运行的应用的软件代码中的安全敏感的汇和从计算系统可访问的数据库检索访问控制策略来实施。访问控制策略将计算系统内的一组访问权限映射到多个主体中的每一个。对于每个检测到的安全敏感接收器，检测到影响该安全敏感信宿的所有主体，并通过对该安全敏感信宿的所有影响主体的访问权限集合的交集来分配每个安全敏感信宿的总访问权限水槽。如果此权限集不足，则会报告完整性违规。此外，权限标签分配给在安全敏感的接收器中使用的变量的每个值。每个权限标签都是一组权限。

4. 发明授权

US08949994B2 Detecting persistent vulnerabilities in web applications 有权
公开(公告)号：US08949994B2
公开(公告)日：2015-02-03
申请号：US13421125
申请日：2012-03-15
申请人： Yair Amit , Omer Tripp
发明人： Yair Amit , Omer Tripp
IPC分类号： G06F21/00 , G06F21/56 , H04L29/06 , G06F21/51 , G06F21/57
CPC分类号： G06F21/563 , G06F21/51 , G06F21/566 , G06F21/577 , H04L63/1433 , H04L63/1466
摘要： A method, including storing a test payload to a persistent state of an application and performing a static analysis to identify a first code location in the application that retrieves the test payload, to identify a first path from an entry point to the first code location, and to identify a second path from the first code location to a second code location that executes a security sensitive operation using the retrieved data. A dynamic analysis is then performed to retrieve the test payload via the first path, and to convey the test payload to the second code location via the second path.

5. 发明授权

US08949991B2 Testing web services that are accessible via service oriented architecture (SOA) interceptors 有权
标题翻译：测试可通过面向服务架构（SOA）拦截器访问的Web服务
公开(公告)号：US08949991B2
公开(公告)日：2015-02-03
申请号：US13016813
申请日：2011-01-28
申请人： Evgeny Beskrovny , Omer Tripp
发明人： Evgeny Beskrovny , Omer Tripp
IPC分类号： G06F11/00 , G06F21/00
CPC分类号： G06F21/00 , G06F21/562 , G06F21/577 , G06F2221/033
摘要： Systems, methods, and computer program products are disclosed for testing web service-related elements, where the instructions of a web service-related element are statically analyzed to identify a characteristic of an output of the web service-related element, and where it is determined from a received response to a web service request that the web service request was processed by the web service-related element if at least a portion of the response matches the characteristic of the output of the web service-related element.
摘要翻译：公开了系统，方法和计算机程序产品，用于测试与Web服务有关的元件的Web服务相关元件的静态分析，以便识别Web服务相关元件的输出的特征，以及它在哪里从所接收到的Web服务请求的响应确定，如果所述响应的至少一部分与所述web服务相关元素的输出的特性匹配，则所述Web服务相关元素处理所述web服务请求。

6. 发明授权

US08935674B2 Determining correctness conditions for use in static analysis 有权
标题翻译：确定用于静态分析的正确性条件
公开(公告)号：US08935674B2
公开(公告)日：2015-01-13
申请号：US13586621
申请日：2012-08-15
申请人： Marco Pistoia , Omer Tripp
发明人： Marco Pistoia , Omer Tripp
IPC分类号： G06F9/44
CPC分类号： G06F8/75 , G06F11/3608
摘要： An embodiment comprising a method is associated with static analysis of a program, which detects violations of conditions of the program correctness specification. The method includes selectively encoding the program and adding one or more correctness conditions to the encoded program, wherein the added conditions comprise a set of assumptions that render the program correct with respect to one or more properties pertaining to detected violations. The set of assumptions are reported to a program user, together with a request to the user to verify the validity of each assumption of the set.
摘要翻译：包括方法的实施例与程序的静态分析相关联，该程序检测违反程序正确性规范的条件。该方法包括选择性地对该程序进行编码并将一个或多个正确性条件加到编码程序中，其中所添加的条件包括使得程序相对于与检测到的违例有关的一个或多个属性使得程序正确的一组假设。一组假设被报告给程序用户，以及向用户请求验证集合的每个假设的有效性的请求。

7. 发明授权

US08756587B2 Static analysis of computer software applications 失效
标题翻译：计算机软件应用的静态分析
公开(公告)号：US08756587B2
公开(公告)日：2014-06-17
申请号：US13250510
申请日：2011-09-30
申请人： Marco Pistoia , Omer Tripp
发明人： Marco Pistoia , Omer Tripp
IPC分类号： G06F9/44
CPC分类号： G06F8/43
摘要： Static analysis of a computer software application can be performed by applying a first level of abstraction to model a plurality of run-time objects, thereby producing a set of object abstractions. Static data-flow analysis of the computer software application can be performed using the set of object abstractions, thereby producing a first data-flow propagation graph. A data-flow bottleneck can be identified within the data-flow propagation graph. A second level of abstraction can be applied to model any of the run-time objects having in the set of object abstractions a corresponding object abstraction that is traceable to the data-flow bottleneck. The applying the second level of abstraction can decompose the corresponding object abstraction into a set of object abstractions, thereby modifying the set of object abstractions. Static data-flow analysis of the computer software application can be performed using the modified set of object abstractions.
摘要翻译：可以通过应用第一级抽象来对多个运行时对象建模来执行计算机软件应用的静态分析，从而产生一组对象抽象。可以使用一组对象抽象来执行计算机软件应用的静态数据流分析，从而产生第一数据流传播图。数据流传输图可以识别数据流瓶颈。可以应用第二级抽象来建模具有对象抽象集合的任何运行时对象，该对象抽象可追溯到数据流瓶颈。应用第二级抽象可以将相应的对象抽象分解成一组对象抽象，从而修改对象抽象集合。计算机软件应用程序的静态数据流分析可以使用修改后的对象抽象集执行。

8. 发明授权

US08752026B2 Efficient code instrumentation 失效
标题翻译：高效的代码工具
公开(公告)号：US08752026B2
公开(公告)日：2014-06-10
申请号：US12475739
申请日：2009-06-01
申请人： Adi Sharabani , Omer Tripp
发明人： Adi Sharabani , Omer Tripp
IPC分类号： G06F9/44 , G06F9/45
CPC分类号： G06F11/3624 , G06F11/3636
摘要： A method for instrumenting a computer program, the method including identifying a program slice within a computer program, and instrumenting the program slice within the program.
摘要翻译：一种用于仪器计算机程序的方法，所述方法包括识别计算机程序内的程序切片，以及在程序内对程序切片进行测量。

9. 发明授权

US08751422B2 Using a heuristically-generated policy to dynamically select string analysis algorithms for client queries 失效
标题翻译：使用启发式生成的策略来动态选择客户端查询的字符串分析算法
公开(公告)号：US08751422B2
公开(公告)日：2014-06-10
申请号：US13270732
申请日：2011-10-11
申请人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06N5/00
CPC分类号： G06N5/00
摘要： A method for dynamically selecting string analysis algorithms can begin with the training of the dynamic string analysis handler of a string analysis module to effectively handle a subset of string queries having contextual metadata received from a client application in an instructional environment. The effectiveness of the training module can be based upon feedback from the client application. Upon completion of the training, a string analysis algorithm selection policy can be synthesized. The string analysis algorithm selection policy can correlate a context of a string query in the subset to the usage of a string analysis algorithm. When in the operational environment, the dynamic string analysis handler can dynamically handle string queries having contextual metadata received from the client application in accordance with the string analysis algorithm selection policy. The string analysis algorithm to be used for a string query can be dynamically and independently determined.
摘要翻译：用于动态选择字符串分析算法的方法可以开始于字符串分析模块的动态字符串分析处理程序的训练，以有效地处理在教学环境中从客户端应用程序接收的具有上下文元数据的字符串查询的子集。培训模块的有效性可以基于客户端应用程序的反馈。完成培训后，可以合成字符串分析算法选择策略。字符串分析算法选择策略可以将子集中的字符串查询的上下文与字符串分析算法的使用相关联。在操作环境中，动态字符串分析处理程序可以根据字符串分析算法选择策略来动态地处理具有从客户端应用程序接收的上下文元数据的字符串查询。用于字符串查询的字符串分析算法可以动态和独立地确定。

10. 发明申请

US20140075562A1 STATIC SECURITY ANALYSIS USING A HYBRID REPRESENTATION OF STRING VALUES 审中-公开
标题翻译：静态安全分析使用混合代表的字符值
公开(公告)号：US20140075562A1
公开(公告)日：2014-03-13
申请号：US13611792
申请日：2012-09-12
申请人： Salvatore A. Guarnieri , Marco Pistoia , Omer Tripp
发明人： Salvatore A. Guarnieri , Marco Pistoia , Omer Tripp
IPC分类号： G06F21/00
CPC分类号： G06F21/577 , G06F17/211 , G06F17/2211 , G06F17/27 , G06F17/272 , G06F17/2765 , G06F21/552 , G06F21/554 , G06F21/563 , H04L63/1408 , H04L63/1433 , H04L63/168
摘要： Systems for constructing hybrid string representations include a string parser configured to parse received string information to produce one or more string components, a database configured to store a set of known concretizations, and a processor configured to compare the one or more string components to the set of known concretizations to determine string components that may be represented concretely, to abstract all string components that could not be represented concretely, and to create a hybrid string representation that includes at least one concrete string component and at least one abstracted string component.
摘要翻译：用于构建混合字符串表示的系统包括：字符串解析器，被配置为解析接收到的字符串信息以产生一个或多个字符串组件;配置为存储一组已知具体化的数据库;以及处理器，被配置为将一个或多个字符串组件与组已知的具体化以确定可能具体表示的字符串组件，以抽象出不能具体表示的所有字符串组件，并创建包含至少一个具体字符串组件和至少一个抽象字符串组件的混合字符串表示。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式