专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

21. 发明申请

US20120297372A1 Static Analysis Of Validator Routines 失效
标题翻译：验证程序的静态分析
公开(公告)号：US20120297372A1
公开(公告)日：2012-11-22
申请号：US13109170
申请日：2011-05-17
申请人： Ryan Berg , Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Ryan Berg , Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06F9/44
CPC分类号： G06F11/3612 , G06F8/436 , G06F11/3604
摘要： A method includes accessing a validator routine having an input string and one or more return points, each return point returning a return value having two possible values; finding the return points in the validator routine; for each of the return points, performing a backwards traversal from a return point through a code section and determining constraints on the input string based at least on one or both of the two possible return values for the return point; using the determined constraints for the input string, determining whether all of the return values returned from the one or more return points meet validation constraints; and outputting one or more indications of whether all of the returned values returned from the return points meet the validation constraints for the one or both of the two possible return values. Apparatus and computer program products are also disclosed.
摘要翻译：一种方法包括访问具有输入字符串和一个或多个返回点的验证器程序，每个返回点返回具有两个可能值的返回值; 找到验证程序的返回点; 对于每个返回点，通过代码部分从返回点执行向后遍历，并且基于返回点的两个可能返回值中的至少一个或两个来确定对输入字符串的约束; 使用确定的输入字符串的约束，确定从一个或多个返回点返回的所有返回值是否满足验证约束; 并且输出一个或多个指示是否从返回点返回的所有返回值是否满足两个可能返回值中的一个或两个的验证约束。还公开了装置和计算机程序产品。

22. 发明申请

US20120266247A1 Automatic Inference Of Whitelist-Based Validation As Part Of Static Analysis For Security 失效
标题翻译：基于白名单的验证的自动推理作为安全性静态分析的一部分
公开(公告)号：US20120266247A1
公开(公告)日：2012-10-18
申请号：US13088711
申请日：2011-04-18
申请人： Lotem Guy , Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Lotem Guy , Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06F21/00
CPC分类号： G06F21/577 , G06F11/3604 , G06F2221/033
摘要： A method includes performing taint analysis of a computer program and determining an original set of paths from sources to sinks. Each path corresponds to a vulnerability. The method includes determining for each variable whose type is a collection and is accessed in one of the paths in the original set of paths whether the variable points to a concrete value whose internal state is not tainted according to the taint analysis. The method further includes, for each of the variables whose type is a collection found not to be tainted according to the taint analysis, determining all points in the computer program where a membership check against the collection is performed. The method also includes, for each of the points, determining corresponding paths and removing those paths from the original set of paths to create a reduced set of paths. Apparatus and computer readable program products are also disclosed.
摘要翻译：一种方法包括执行计算机程序的污点分析和确定从源到汇的原始路径集合。每个路径对应于一个漏洞。该方法包括为类型是集合的每个变量确定，并且在原始路径集合中的一个路径中访问，无论变量是否根据污点分析指向其内部状态不被污染的具体值。该方法还包括对于根据污点分析发现其不被污染的类型的每个变量，确定计算机程序中针对集合进行成员资格检查的所有点。该方法还包括对于每个点，确定相应的路径并且从原始路径集合去除那些路径以创建减少的路径集合。还公开了装置和计算机可读程序产品。

23. 发明申请

US20120131669A1 Determining whether method of computer program is a validator 失效
标题翻译：确定计算机程序的方法是否为验证程序
公开(公告)号：US20120131669A1
公开(公告)日：2012-05-24
申请号：US12950432
申请日：2010-11-19
申请人： Takaaki Tateishi , Marco Pistoia , Omer Tripp , Ryan Berg , Robert Wiener
发明人： Takaaki Tateishi , Marco Pistoia , Omer Tripp , Ryan Berg , Robert Wiener
IPC分类号： G06F21/00
CPC分类号： G06F21/50 , G06F21/563
摘要： An illegal pattern and a computer program having a method are received. The method has one or more return statements, and a number of basic blocks. The method is normalized so that each return statement of the target method relating to the illegal pattern returns a constant Boolean value. A first path condition and a second path condition for one or more corresponding paths is determined such that one or more corresponding basic blocks return a constant Boolean value of true for the first path condition and a constant Boolean value of false for the second path condition. An unsatisfiability of each path condition is determined using a monadic second-order logic (M2L) technique. Where the unsatisfiability of either path condition is false, the method is reported as not being a validator. Where the unsatisfiability of either path condition is true, the method is reported as being a validator.
摘要翻译：接收到具有方法的非法模式和计算机程序。该方法具有一个或多个返回语句和一些基本块。该方法被归一化，使得与非法模式相关的目标方法的每个返回语句返回一个常量布尔值。确定用于一个或多个对应路径的第一路径条件和第二路径条件，使得一个或多个对应的基本块返回针对第一路径条件的常数布尔值为true，对于第二路径条件返回常量布尔值为假。使用一元二阶逻辑（M2L）技术确定每个路径条件的不满足性。如果任一路径条件的不满足性为假，则将该方法报告为不是验证器。如果任一路径条件的不满足性为真，则将该方法报告为验证器。

24. 发明授权

US08751422B2 Using a heuristically-generated policy to dynamically select string analysis algorithms for client queries 失效
标题翻译：使用启发式生成的策略来动态选择客户端查询的字符串分析算法
公开(公告)号：US08751422B2
公开(公告)日：2014-06-10
申请号：US13270732
申请日：2011-10-11
申请人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06N5/00
CPC分类号： G06N5/00
摘要： A method for dynamically selecting string analysis algorithms can begin with the training of the dynamic string analysis handler of a string analysis module to effectively handle a subset of string queries having contextual metadata received from a client application in an instructional environment. The effectiveness of the training module can be based upon feedback from the client application. Upon completion of the training, a string analysis algorithm selection policy can be synthesized. The string analysis algorithm selection policy can correlate a context of a string query in the subset to the usage of a string analysis algorithm. When in the operational environment, the dynamic string analysis handler can dynamically handle string queries having contextual metadata received from the client application in accordance with the string analysis algorithm selection policy. The string analysis algorithm to be used for a string query can be dynamically and independently determined.
摘要翻译：用于动态选择字符串分析算法的方法可以开始于字符串分析模块的动态字符串分析处理程序的训练，以有效地处理在教学环境中从客户端应用程序接收的具有上下文元数据的字符串查询的子集。培训模块的有效性可以基于客户端应用程序的反馈。完成培训后，可以合成字符串分析算法选择策略。字符串分析算法选择策略可以将子集中的字符串查询的上下文与字符串分析算法的使用相关联。在操作环境中，动态字符串分析处理程序可以根据字符串分析算法选择策略来动态地处理具有从客户端应用程序接收的上下文元数据的字符串查询。用于字符串查询的字符串分析算法可以动态和独立地确定。

25. 发明授权

US08572674B2 System, method, and apparatus for modular, string-sensitive, access rights analysis with demand-driven precision 有权
标题翻译：用于采用需求驱动精度的模块化，字符串敏感的访问权限分析的系统，方法和设备
公开(公告)号：US08572674B2
公开(公告)日：2013-10-29
申请号：US12190718
申请日：2008-08-13
申请人： Julian Timothy Dolby , Emmanuel Geay , Marco Pistoia , Barbara G. Ryder , Takaaki Tateishi
发明人： Julian Timothy Dolby , Emmanuel Geay , Marco Pistoia , Barbara G. Ryder , Takaaki Tateishi
IPC分类号： H04L29/06
CPC分类号： G06F21/57 , G06F21/53 , G06F21/6218
摘要： A static analysis for identification of permission-requirements on stack-inspection authorization systems is provided. The analysis employs functional modularity for improved scalability. To enhance precision, the analysis utilizes program slicing to detect the origin of each parameter passed to a security-sensitive function. Furthermore, since strings are essential when defining permissions, the analysis integrates a sophisticated string analysis that models string computations.
摘要翻译：提供了一个用于识别堆栈检查授权系统的许可要求的静态分析。该分析采用功能模块化，以提高可扩展性。为了提高精度，分析使用程序分片来检测传递给安全敏感功能的每个参数的原点。此外，由于字符串在定义权限时至关重要，因此分析集成了一个用于模拟字符串计算的复杂字符串分析。

26. 发明授权

US08533694B2 Identification of read/write chains during static analysis of computer software 有权
标题翻译：在计算机软件的静态分析期间识别读/写链
公开(公告)号：US08533694B2
公开(公告)日：2013-09-10
申请号：US12129894
申请日：2008-05-30
申请人： Marco Pistoia , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Marco Pistoia , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F9/45 , G06F7/00 , G06F17/30
CPC分类号： G06F8/433
摘要： A system for identifying read/write chains in computer software, including a static analysis engine identifying within computer software logical container accesses, a string analyzer configured to at least partly resolve any variables identifying the logical container in any of the accesses by determining a set of potential values of any of the variables, and a Logical Container Access Virtualization component (LCAV) configured to identify the type and scope of any permutations of the accesses, where each of the permutations is defined by substituting any of the potential values for any of the access variables, and identify any read/write chains within the computer software by matching any of the access permutations that read from the logical container with any of the access permutations that write to the logical container if there is an intersection between the scopes of the read and write access permutations.
摘要翻译：一种用于识别计算机软件中的读/写链的系统，包括在计算机软件逻辑容器访问内识别的静态分析引擎，串行分析器，其被配置为至少部分地解析任何访问中识别逻辑容器的任何变量，任何变量的潜在值和逻辑容器访问虚拟化组件（LCAV），其被配置为识别访问的任何排列的类型和范围，其中每个排列通过将任何潜在值替换为任何访问变量，并通过将从逻辑容器读取的任何访问排列与写入逻辑容器的任何访问排列进行匹配，以识别计算机软件中的任何读/写链，如果读取范围之间存在交集并写入访问排列。

27. 发明授权

US08365280B2 System, method, and program for determining validity of string 失效
标题翻译：用于确定字符串有效性的系统，方法和程序
公开(公告)号：US08365280B2
公开(公告)日：2013-01-29
申请号：US12825610
申请日：2010-06-29
申请人： Yinnon Avraham Haviv , Marco Pistoia , Naoshi Tabuchi , Takaaki Tateishi
发明人： Yinnon Avraham Haviv , Marco Pistoia , Naoshi Tabuchi , Takaaki Tateishi
IPC分类号： G06F11/00
CPC分类号： G06F21/577 , G06F8/43 , G06F11/3604 , G06F21/563
摘要： A computer-implemented method, program product, and system for determining the validity of a string generated by a computer programming language program. The method includes: abstracting a constraint between variables extracted from a source code for a programming language, describing the constraint in M2L, and storing the constraint; and evaluating the validity of the string on an M2L solver on the basis of the constraint and a M2L specification to determine whether the string is safe or unsafe.
摘要翻译：用于确定由计算机程序设计语言程序生成的字符串的有效性的计算机实现的方法，程序产品和系统。该方法包括：从用于编程语言的源代码提取的变量之间抽取约束，描述M2L中的约束，并存储该约束; 并基于约束和M2L规范来评估M2L求解器上的字符串的有效性，以确定字符串是安全还是不安全。

28. 发明授权

US08898188B2 String analysis based on three-valued logic 有权
标题翻译：基于三值逻辑的字符串分析
公开(公告)号：US08898188B2
公开(公告)日：2014-11-25
申请号：US13154986
申请日：2011-06-07
申请人： Marco Pistoia , Omer Tripp , Takaaki Tateishi
发明人： Marco Pistoia , Omer Tripp , Takaaki Tateishi
IPC分类号： G06F17/30 , G06F11/36
CPC分类号： G06F11/3608 , G06F2201/81
摘要： Performing string analysis based on three-valued logic by including expressing a property of a string in a computer software application as a three-valued logic shape predicate, performing a three-valued logic shape analysis using the shape predicate to reach a fixpoint solution, and evaluating the fixpoint solution to determine a three-valued logic value of the property.
摘要翻译：通过将计算机软件应用程序中的字符串的属性表示为三值逻辑形状谓词来执行基于三值逻辑的字符串分析，使用形状谓词执行三值逻辑形状分析以达到固定点解决方案，以及评估fixpoint解决方案以确定属性的三值逻辑值。

29. 发明授权

US08726246B2 Static analysis of validator routines 失效
标题翻译：验证程序的静态分析
公开(公告)号：US08726246B2
公开(公告)日：2014-05-13
申请号：US13109170
申请日：2011-05-17
申请人： Ryan Berg , Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Ryan Berg , Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06F9/44
CPC分类号： G06F11/3612 , G06F8/436 , G06F11/3604
摘要： A method includes accessing a validator routine having an input string and one or more return points, each return point returning a return value having two possible values; finding the return points in the validator routine; for each of the return points, performing a backwards traversal from a return point through a code section and determining constraints on the input string based at least on one or both of the two possible return values for the return point; using the determined constraints for the input string, determining whether all of the return values returned from the one or more return points meet validation constraints; and outputting one or more indications of whether all of the returned values returned from the return points meet the validation constraints for the one or both of the two possible return values. Apparatus and computer program products are also disclosed.
摘要翻译：一种方法包括访问具有输入字符串和一个或多个返回点的验证器程序，每个返回点返回具有两个可能值的返回值; 找到验证程序的返回点; 对于每个返回点，通过代码部分从返回点执行向后遍历，并且基于返回点的两个可能返回值中的至少一个或两个来确定对输入字符串的约束; 使用确定的输入字符串的约束，确定从一个或多个返回点返回的所有返回值是否满足验证约束; 并且输出一个或多个指示是否从返回点返回的所有返回值是否满足两个可能返回值中的一个或两个的验证约束。还公开了装置和计算机程序产品。

30. 发明申请

US20120210432A1 LABEL-BASED TAINT ANALYSIS 失效
标题翻译：基于标签的分析
公开(公告)号：US20120210432A1
公开(公告)日：2012-08-16
申请号：US13028237
申请日：2011-02-16
申请人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
发明人： Marco Pistoia , Takaaki Tateishi , Omer Tripp
IPC分类号： G06F11/00 , G06F9/44
CPC分类号： G06F11/3604
摘要： A computer-implemented method and apparatus, adapted to receive a computer program, and dynamically analyze the computer program to determine flow of untrusted data with respect to a computer resource associated with the computer program. Based on the flow of untrusted data, the method and apparatus determine an abstraction of the computerized resource, and performing static analysis of the computer program with respect to the abstraction, wherein the static analysis is for identifying whether the computer program is susceptible to one or more possible security vulnerabilities.
摘要翻译：一种计算机实现的方法和装置，适于接收计算机程序，并且动态分析所述计算机程序以确定相对于与所述计算机程序相关联的计算机资源的不受信任数据的流动。基于不可信数据的流程，该方法和装置确定计算机化资源的抽象，并且针对抽象执行计算机程序的静态分析，其中静态分析用于识别计算机程序是否易受一个或多个更多可能的安全漏洞。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式