专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明申请

US20120159619A1 Formal Analysis of the Quality and Conformance of Information Flow Downgraders 有权
标题翻译：信息流降级的质量和一致性的正式分析
公开(公告)号：US20120159619A1
公开(公告)日：2012-06-21
申请号：US12968646
申请日：2010-12-15
申请人： Ryan J. Berg , Marco Pistoia , Takaaki Tateishi , Stephen D. Teilhet , Omer Tripp
发明人： Ryan J. Berg , Marco Pistoia , Takaaki Tateishi , Stephen D. Teilhet , Omer Tripp
IPC分类号： G06F21/00 , G06F9/44
CPC分类号： G06F21/50 , G06F21/577
摘要： Mechanisms for evaluating downgrader code in application code with regard to one or more security guidelines are provided. Downgrader code in application code is identified, where the downgrader code is a portion of code in the application code that operates on an information flow of the application code to ensure confidentiality of information input to the downgrader code, in the output of the downgrader code. Processes of the downgrader code are evaluated against security guidelines to determine if the processes violate the security guidelines. A notification is generated in response to the evaluation indicating that the processes of the downgrader code violate the security guidelines. The notification is output to a computing device for consideration.
摘要翻译：提供了关于一个或多个安全指南的应用程序代码评估降级代码的机制。识别应用代码中的降级代码，其中降级代码是应用代码中的代码的一部分，其在应用代码的信息流上操作，以确保降级代码的输出中输入降级代码的信息的机密性。根据安全准则评估降级代码的过程，以确定进程是否违反安全性准则。产生响应于评估的通知，指示降级代码的处理违反安全准则。该通知被输出到计算设备以供考虑。

2. 发明授权

US08667584B2 Formal analysis of the quality and conformance of information flow downgraders 有权
公开(公告)号：US08667584B2
公开(公告)日：2014-03-04
申请号：US12968646
申请日：2010-12-15
申请人： Ryan J. Berg , Marco Pistoia , Takaaki Tateishi , Stephen D. Teilhet , Omer Tripp
发明人： Ryan J. Berg , Marco Pistoia , Takaaki Tateishi , Stephen D. Teilhet , Omer Tripp
IPC分类号： G06F21/00
CPC分类号： G06F21/50 , G06F21/577
摘要： Mechanisms for evaluating downgrader code in application code with regard to one or more security guidelines are provided. Downgrader code in application code is identified, where the downgrader code is a portion of code in the application code that operates on an information flow of the application code to ensure confidentiality of information input to the downgrader code, in the output of the downgrader code. Processes of the downgrader code are evaluated against security guidelines to determine if the processes violate the security guidelines. A notification is generated in response to the evaluation indicating that the processes of the downgrader code violate the security guidelines. The notification is output to a computing device for consideration.

3. 发明申请

US20130086686A1 Automated Detection of Flaws and Incompatibility Problems in Information Flow Downgraders 有权
标题翻译：自动检测信息流降级中的缺陷和不兼容性问题
公开(公告)号：US20130086686A1
公开(公告)日：2013-04-04
申请号：US13248724
申请日：2011-09-29
申请人： Marco Pistoia , Takaaki Tateishi , Stephen D. Teilhet , Omer Tripp
发明人： Marco Pistoia , Takaaki Tateishi , Stephen D. Teilhet , Omer Tripp
IPC分类号： G06F21/00
CPC分类号： G06F21/577 , G06F21/00 , G06F21/50
摘要： Mechanisms for evaluating downgrader code in application code with regard to a target deployment environment. Downgrader code in the application code is identified. Based on an input string, an output string that the downgrader code outputs in response to receiving the input string is identified. One or more sets of illegal string patterns are retrieved. Each of the one or more sets of illegal string patterns is associated with a corresponding deployment environment. The illegal string patterns are string patterns that a downgrader identifies in the information flow for security purposes. A determination is made as to whether the downgrader code is compatible with the target deployment environment based on the one or more sets of illegal string patterns and the output string. An output indicative of the results of the determining is generated.
摘要翻译：评估应用程序代码中关于目标部署环境的降级代码的机制。识别应用程序代码中的降级代码。基于输入字符串，识别降级代码响应于输入字符串而输出的输出字符串。检索一组或多组非法字符串模式。一组或多组非法字符串模式中的每一个与相应的部署环境相关联。非法字符串模式是为了安全起见，降级标识在信息流中的字符串模式。基于一组或多组非法字符串模式和输出字符串，确定降级代码是否与目标部署环境兼容。产生指示确定结果的输出。

4. 发明授权

US08769696B2 Automated detection of flaws and incompatibility problems in information flow downgraders 有权
标题翻译：自动检测信息流下载中的缺陷和不兼容问题
公开(公告)号：US08769696B2
公开(公告)日：2014-07-01
申请号：US13248724
申请日：2011-09-29
申请人： Marco Pistoia , Takaaki Tateishi , Stephen D. Teilhet , Omer Tripp
发明人： Marco Pistoia , Takaaki Tateishi , Stephen D. Teilhet , Omer Tripp
IPC分类号： G06F11/00 , G06F12/14 , G06F12/16 , G08B23/00
CPC分类号： G06F21/577 , G06F21/00 , G06F21/50
摘要： Mechanisms for evaluating downgrader code in application code with regard to a target deployment environment. Downgrader code in the application code is identified. Based on an input string, an output string that the downgrader code outputs in response to receiving the input string is identified. One or more sets of illegal string patterns are retrieved. Each of the one or more sets of illegal string patterns is associated with a corresponding deployment environment. The illegal string patterns are string patterns that a downgrader identifies in the information flow for security purposes. A determination is made as to whether the downgrader code is compatible with the target deployment environment based on the one or more sets of illegal string patterns and the output string. An output indicative of the results of the determining is generated.
摘要翻译：评估应用程序代码中关于目标部署环境的降级代码的机制。识别应用程序代码中的降级代码。基于输入字符串，识别降级代码响应于输入字符串而输出的输出字符串。检索一组或多组非法字符串模式。一组或多组非法字符串模式中的每一个与相应的部署环境相关联。非法字符串模式是为了安全起见，降级标识在信息流中的字符串模式。基于一组或多组非法字符串模式和输出字符串，确定降级代码是否与目标部署环境兼容。产生指示确定结果的输出。

5. 发明申请

US20130091079A1 USING A HEURISTICALLY-GENERATED POLICY TO DYNAMICALLY SELECT STRING ANALYSIS ALGORITHMS FOR CLIENT QUERIES 有权
标题翻译：使用全景生成策略动态选择客户端查询的分析算法
公开(公告)号：US20130091079A1
公开(公告)日：2013-04-11
申请号：US13412121
申请日：2012-03-05
申请人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06F15/18
CPC分类号： G06N5/00
摘要： A method for dynamically selecting string analysis algorithms can begin with the training of the dynamic string analysis handler of a string analysis module to effectively handle a subset of string queries having contextual metadata received from a client application in an instructional environment. The effectiveness of the training module can be based upon feedback from the client application. Upon completion of the training, a string analysis algorithm selection policy can be synthesized. The string analysis algorithm selection policy can correlate a context of a string query in the subset to the usage of a string analysis algorithm. When in the operational environment, the dynamic string analysis handler can dynamically handle string queries having contextual metadata received from the client application in accordance with the string analysis algorithm selection policy. The string analysis algorithm to be used for a string query can be dynamically and independently determined.
摘要翻译：用于动态选择字符串分析算法的方法可以开始于字符串分析模块的动态字符串分析处理程序的训练，以有效地处理在教学环境中从客户端应用程序接收的具有上下文元数据的字符串查询的子集。培训模块的有效性可以基于客户端应用程序的反馈。完成培训后，可以合成字符串分析算法选择策略。字符串分析算法选择策略可以将子集中的字符串查询的上下文与字符串分析算法的使用相关联。在操作环境中，动态字符串分析处理程序可以根据字符串分析算法选择策略来动态地处理具有从客户端应用程序接收的上下文元数据的字符串查询。用于字符串查询的字符串分析算法可以动态和独立地确定。

6. 发明授权

US08365281B2 Determining whether method of computer program is a validator 失效
标题翻译：确定计算机程序的方法是否为验证程序
公开(公告)号：US08365281B2
公开(公告)日：2013-01-29
申请号：US12950432
申请日：2010-11-19
申请人： Takaaki Tateishi , Marco Pistoia , Omer Tripp , Ryan Berg , Robert Wiener
发明人： Takaaki Tateishi , Marco Pistoia , Omer Tripp , Ryan Berg , Robert Wiener
IPC分类号： G06F11/00 , G06F11/30 , H04L29/06 , H04L9/32
CPC分类号： G06F21/50 , G06F21/563
摘要： An illegal pattern and a computer program having a method are received. The method has one or more return statements, and a number of basic blocks. The method is normalized so that each return statement of the target method relating to the illegal pattern returns a constant Boolean value. A first path condition and a second path condition for one or more corresponding paths is determined such that one or more corresponding basic blocks return a constant Boolean value of true for the first path condition and a constant Boolean value of false for the second path condition. An unsatisfiability of each path condition is determined using a monadic second-order logic (M2L) technique. Where the unsatisfiability of either path condition is false, the method is reported as not being a validator. Where the unsatisfiability of either path condition is true, the method is reported as being a validator.
摘要翻译：接收到具有方法的非法模式和计算机程序。该方法具有一个或多个返回语句和一些基本块。该方法被归一化，使得与非法模式相关的目标方法的每个返回语句返回一个常量布尔值。确定用于一个或多个对应路径的第一路径条件和第二路径条件，使得一个或多个对应的基本块返回针对第一路径条件的常数布尔值为true，对于第二路径条件返回常量布尔值为假。使用一元二阶逻辑（M2L）技术确定每个路径条件的不满足性。如果任一路径条件的不满足性为假，则将该方法报告为不是验证器。如果任一路径条件的不满足性为真，则将该方法报告为验证器。

7. 发明申请

US20120023486A1 Verification of Information-Flow Downgraders 失效
标题翻译：信息流降级的验证
公开(公告)号：US20120023486A1
公开(公告)日：2012-01-26
申请号：US12843308
申请日：2010-07-26
申请人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F9/44
CPC分类号： G06F21/577 , H04L63/105
摘要： A method includes determining grammar for output of an information-flow downgrader in a software program. The software program directs the output of the information-flow downgrader to a sink. The method includes determining whether the grammar of the output conforms to one or more predetermined specifications of the sink. The method includes, in response to a determination the grammar of the output conforms to the one or more predetermined specifications of the sink, determining the information-flow downgrader is verified for the sink, wherein determining grammar, determining whether the grammar, and determining the information-flow downgrader are performed via static analysis of the software program. Apparatus and computer program products are also disclosed. An apparatus includes a user interface providing a result of whether or not output of an information-flow downgrader in the software program conforms to one or more predetermined specifications of a sink in the software program.
摘要翻译：一种方法包括在软件程序中确定信息流降级器的输出的语法。软件程序将信息流降级器的输出引导到宿。该方法包括确定输出的语法是否符合汇的一个或多个预定规范。该方法包括响应于确定，输出的语法符合信宿的一个或多个预定规范，确定信宿流降级器对于汇点进行验证，其中确定语法，确定语法，并确定信息流降级器通过软件程序的静态分析来执行。还公开了装置和计算机程序产品。一种装置，包括提供软件程序中的信息流下载器的输出是否符合软件程序中的接收器的一个或多个预定规格的结果的用户界面。

8. 发明授权

US09092723B2 Using a heuristically-generated policy to dynamically select string analysis algorithms for client queries 有权
标题翻译：使用启发式生成的策略来动态选择客户端查询的字符串分析算法
公开(公告)号：US09092723B2
公开(公告)日：2015-07-28
申请号：US13412121
申请日：2012-03-05
申请人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06N5/00
CPC分类号： G06N5/00
摘要： A method for dynamically selecting string analysis algorithms can begin with the training of the dynamic string analysis handler of a string analysis module to effectively handle a subset of string queries having contextual metadata received from a client application in an instructional environment. The effectiveness of the training module can be based upon feedback from the client application. Upon completion of the training, a string analysis algorithm selection policy can be synthesized. The string analysis algorithm selection policy can correlate a context of a string query in the subset to the usage of a string analysis algorithm. When in the operational environment, the dynamic string analysis handler can dynamically handle string queries having contextual metadata received from the client application in accordance with the string analysis algorithm selection policy. The string analysis algorithm to be used for a string query can be dynamically and independently determined.
摘要翻译：用于动态选择字符串分析算法的方法可以开始于字符串分析模块的动态字符串分析处理程序的训练，以有效地处理在教学环境中从客户端应用程序接收的具有上下文元数据的字符串查询的子集。培训模块的有效性可以基于客户端应用程序的反馈。完成培训后，可以合成字符串分析算法选择策略。字符串分析算法选择策略可以将子集中的字符串查询的上下文与字符串分析算法的使用相关联。在操作环境中，动态字符串分析处理程序可以根据字符串分析算法选择策略来动态地处理具有从客户端应用程序接收的上下文元数据的字符串查询。用于字符串查询的字符串分析算法可以动态和独立地确定。

9. 发明授权

US08650546B2 Static analysis based on observed string values during execution of a computer-based software application 失效
标题翻译：在基于计算机的软件应用程序执行期间，基于观察到的字符串值的静态分析
公开(公告)号：US08650546B2
公开(公告)日：2014-02-11
申请号：US13173012
申请日：2011-06-30
申请人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06F9/44
CPC分类号： G06F11/3608
摘要： Improving static analysis precision by recording a value pointed to by a string variable within the computer-based software application during the execution of a computer-based software application, modeling an invariant based on the recorded value, where the invariant represents at least one possible value pointed to by the string variable, performing a first static analysis of the computer-based software application to determine whether the invariant is valid with respect to the computer-based software application, and seeding a second static analysis of the computer-based software application with the invariant if the invariant is valid with respect to the computer-based software application.
摘要翻译：通过在执行基于计算机的软件应用程序期间记录基于计算机的软件应用程序中由字符串变量指向的值来提高静态分析精度，基于记录的值对不变量建模，其中不变量表示至少一个可能的值由字符串变量指向，对基于计算机的软件应用进行第一静态分析，以确定相对于基于计算机的软件应用是否不变量是否有效;以及将基于计算机的软件应用的第二静态分析与如果不变式对于基于计算机的软件应用程序是有效的则不变量。

10. 发明授权

US08572748B2 Label-based taint analysis 失效
标题翻译：基于标签的污染分析
公开(公告)号：US08572748B2
公开(公告)日：2013-10-29
申请号：US13028237
申请日：2011-02-16
申请人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06F12/14 , G08B23/00 , G06F11/00
CPC分类号： G06F11/3604
摘要： A computer-implemented method and apparatus, adapted to receive a computer program, and dynamically analyze the computer program to determine flow of untrusted data with respect to a computer resource associated with the computer program. Based on the flow of untrusted data, the method and apparatus determine an abstraction of the computerized resource, and performing static analysis of the computer program with respect to the abstraction, wherein the static analysis is for identifying whether the computer program is susceptible to one or more possible security vulnerabilities.
摘要翻译：一种计算机实现的方法和装置，适于接收计算机程序，并且动态分析所述计算机程序以确定相对于与所述计算机程序相关联的计算机资源的不受信任数据的流动。基于不可信数据的流程，该方法和装置确定计算机化资源的抽象，并且针对抽象执行计算机程序的静态分析，其中静态分析用于识别计算机程序是否易受一个或多个更多可能的安全漏洞。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式