专利快速检索-快速检索全球专利，免费商用专利数据库-IPRDB

1. 发明授权

US09720798B2 Simulating black box test results using information from white box testing 有权
公开(公告)号：US09720798B2
公开(公告)日：2017-08-01
申请号：US13493067
申请日：2012-06-11
申请人： Stephen Fink , Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Manu Sridharan , Frank Tip , Omer Tripp , Omri Weisman
发明人： Stephen Fink , Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Manu Sridharan , Frank Tip , Omer Tripp , Omri Weisman
IPC分类号： G06F9/44 , G06F9/45 , G06F11/36 , G06F9/445 , G06F9/455 , G06F21/57
CPC分类号： G06F11/3604 , G06F9/44589 , G06F9/455 , G06F11/36 , G06F11/362 , G06F21/577 , G06F2221/033
摘要： Systems, methods are program products for simulating black box test results using information obtained from white box testing, including analyzing computer software (e.g., an application) to identify a potential vulnerability within the computer software application and a plurality of milestones associated with the potential vulnerability, where each of the milestones indicates a location within the computer software application, tracing a path from a first one of the milestones to an entry point into the computer software application, identifying an input to the entry point that would result in a control flow from the entry point and through each of the milestones, describing the potential vulnerability in a description indicating the entry point and the input, and presenting the description via a computer-controlled output medium.

2. 发明申请

US20120254839A1 SIMULATING BLACK BOX TEST RESULTS USING INFORMATION FROM WHITE BOX TESTING 有权
标题翻译：使用白盒测试中的信息模拟黑盒测试结果
公开(公告)号：US20120254839A1
公开(公告)日：2012-10-04
申请号：US13493067
申请日：2012-06-11
申请人： Stephen Fink , Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Manu Sridharan , Frank Tip , Omer Tripp , Omri Weisman
发明人： Stephen Fink , Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Manu Sridharan , Frank Tip , Omer Tripp , Omri Weisman
IPC分类号： G06F9/44
CPC分类号： G06F11/3604 , G06F9/44589 , G06F9/455 , G06F11/36 , G06F11/362 , G06F21/577 , G06F2221/033
摘要： Systems, methods are program products for simulating black box test results using information obtained from white box testing, including analyzing computer software (e.g., an application) to identify a potential vulnerability within the computer software application and a plurality of milestones associated with the potential vulnerability, where each of the milestones indicates a location within the computer software application, tracing a path from a first one of the milestones to an entry point into the computer software application, identifying an input to the entry point that would result in a control flow from the entry point and through each of the milestones, describing the potential vulnerability in a description indicating the entry point and the input, and presenting the description via a computer-controlled output medium.
摘要翻译：系统，方法是使用从白盒测试获得的信息来模拟黑盒测试结果的程序产品，包括分析计算机软件（例如应用程序）以识别计算机软件应用程序中的潜在漏洞以及与潜在漏洞相关联的多个里程碑，其中每个里程碑指示计算机软件应用程序内的位置，跟踪从第一个里程碑到入口点的路径到计算机软件应用程序中，识别入口点的输入将导致控制流从描述在描述入口点和输入的描述中的潜在漏洞，以及经由计算机控制的输出介质呈现描述的入口点和通过每个里程碑。

3. 发明授权

US09747187B2 Simulating black box test results using information from white box testing 有权
公开(公告)号：US09747187B2
公开(公告)日：2017-08-29
申请号：US12913314
申请日：2010-10-27
申请人： Stephen Fink , Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Manu Sridharan , Frank Tip , Omer Tripp , Omri Weisman
发明人： Stephen Fink , Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Manu Sridharan , Frank Tip , Omer Tripp , Omri Weisman
IPC分类号： G06F11/36 , G06F9/445 , G06F9/455 , G06F21/57
CPC分类号： G06F11/3604 , G06F9/44589 , G06F9/455 , G06F11/36 , G06F11/362 , G06F21/577 , G06F2221/033
摘要： Systems, methods are program products for simulating black box test results using information obtained from white box testing, including analyzing computer software (e.g., an application) to identify a potential vulnerability within the computer software application and a plurality of milestones associated with the potential vulnerability, where each of the milestones indicates a location within the computer software application, tracing a path from a first one of the milestones to an entry point into the computer software application, identifying an input to the entry point that would result in a control flow from the entry point and through each of the milestones, describing the potential vulnerability in a description indicating the entry point and the input, and presenting the description via a computer-controlled output medium.

4. 发明申请

US20120110551A1 SIMULATING BLACK BOX TEST RESULTS USING INFORMATION FROM WHITE BOX TESTING 有权
公开(公告)号：US20120110551A1
公开(公告)日：2012-05-03
申请号：US12913314
申请日：2010-10-27
申请人： Stephen Fink , Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Manu Sridharan , Frank Tip , Omer Tripp , Omri Weisman
发明人： Stephen Fink , Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Manu Sridharan , Frank Tip , Omer Tripp , Omri Weisman
IPC分类号： G06F11/36
CPC分类号： G06F11/3604 , G06F9/44589 , G06F9/455 , G06F11/36 , G06F11/362 , G06F21/577 , G06F2221/033
摘要： Systems, methods are program products for simulating black box test results using information obtained from white box testing, including analyzing computer software (e.g., an application) to identify a potential vulnerability within the computer software application and a plurality of milestones associated with the potential vulnerability, where each of the milestones indicates a location within the computer software application, tracing a path from a first one of the milestones to an entry point into the computer software application, identifying an input to the entry point that would result in a control flow from the entry point and through each of the milestones, describing the potential vulnerability in a description indicating the entry point and the input, and presenting the description via a computer-controlled output medium.

5. 发明授权

US08528095B2 Injection context based static analysis of computer software applications 有权
标题翻译：基于注入场景的静态分析计算机软件应用
公开(公告)号：US08528095B2
公开(公告)日：2013-09-03
申请号：US12825293
申请日：2010-06-28
申请人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Ory Segal , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F11/00 , H04L9/32 , G06F15/173 , G06F9/44
CPC分类号： G06F11/3604 , G06F8/75 , G06F21/577
摘要： Embodiments of the invention generally relate to injection context based static analysis of computer software applications. Embodiments of the invention may include selecting a sink within a computer software application, tracing a character output stream leading to the sink within the computer software application, determining an injection context of the character output stream at the sink, where the injection context is predefined in association with a state of the character output stream at the sink, identifying any actions that have been predefined in association with the identified injection context, and providing a report of the actions.
摘要翻译：本发明的实施例一般涉及计算机软件应用的基于注入上下文的静态分析。本发明的实施例可以包括选择计算机软件应用程序内的汇点，跟踪通向计算机软件应用程序内的汇点的字符输出流，确定汇点处的字符输出流的注入上下文，其中注入上下文在与汇点处的字符输出流的状态相关联，识别已经与所识别的注入上下文相关联地预定义的任何动作，以及提供动作的报告。

6. 发明申请

US20120023486A1 Verification of Information-Flow Downgraders 失效
标题翻译：信息流降级的验证
公开(公告)号：US20120023486A1
公开(公告)日：2012-01-26
申请号：US12843308
申请日：2010-07-26
申请人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F9/44
CPC分类号： G06F21/577 , H04L63/105
摘要： A method includes determining grammar for output of an information-flow downgrader in a software program. The software program directs the output of the information-flow downgrader to a sink. The method includes determining whether the grammar of the output conforms to one or more predetermined specifications of the sink. The method includes, in response to a determination the grammar of the output conforms to the one or more predetermined specifications of the sink, determining the information-flow downgrader is verified for the sink, wherein determining grammar, determining whether the grammar, and determining the information-flow downgrader are performed via static analysis of the software program. Apparatus and computer program products are also disclosed. An apparatus includes a user interface providing a result of whether or not output of an information-flow downgrader in the software program conforms to one or more predetermined specifications of a sink in the software program.
摘要翻译：一种方法包括在软件程序中确定信息流降级器的输出的语法。软件程序将信息流降级器的输出引导到宿。该方法包括确定输出的语法是否符合汇的一个或多个预定规范。该方法包括响应于确定，输出的语法符合信宿的一个或多个预定规范，确定信宿流降级器对于汇点进行验证，其中确定语法，确定语法，并确定信息流降级器通过软件程序的静态分析来执行。还公开了装置和计算机程序产品。一种装置，包括提供软件程序中的信息流下载器的输出是否符合软件程序中的接收器的一个或多个预定规格的结果的用户界面。

7. 发明授权

US08468605B2 Identifying security vulnerability in computer software 有权
标题翻译：识别计算机软件中的安全漏洞
公开(公告)号：US08468605B2
公开(公告)日：2013-06-18
申请号：US12627351
申请日：2009-11-30
申请人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon A. Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F12/14 , G06F12/16 , G06F11/00 , G08B23/00 , G06F11/30 , G06F9/44
CPC分类号： G06F21/566
摘要： Identifying a security vulnerability in a computer software application by identifying at least one source in a computer software application, identifying at least one sink in the computer software application, identifying at least one input to any of the sinks, determining whether the input derives its value directly or indirectly from any of the sources, determining a set of possible values for the input, and identifying a security vulnerability where the set of possible values for the input does not match a predefined specification of legal values associated with the sink input.
摘要翻译：通过识别计算机软件应用中的至少一个源来识别计算机软件应用中的安全漏洞，识别计算机软件应用中的至少一个接收器，识别任何接收器的至少一个输入，确定输入是否导出其值直接或间接地从任何来源确定输入的一组可能的值，以及识别安全漏洞，其中输入的可能值的集合不与预定义的与接收器输入相关联的合法值的规范相匹配。

8. 发明授权

US08584246B2 Eliminating false reports of security vulnerabilities when testing computer software 失效
标题翻译：在测试计算机软件时，消除安全漏洞的虚假报告
公开(公告)号：US08584246B2
公开(公告)日：2013-11-12
申请号：US12578013
申请日：2009-10-13
申请人： Yinnon Avraham Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon Avraham Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F12/14
CPC分类号： G06F21/57 , G06F11/3692
摘要： A system for eliminating false reports of security vulnerabilities when testing computer software, including a taint analysis engine configured to identify a tainted variable v in a computer application, a data mapping identification engine configured to identify a variable x within the application that holds data derived from v, where x is in a different format than v, an AddData identification engine configured to identify an AddData operation within the application that is performed on x, a signature identification engine configured to identify a Sign operation within the application that is performed on the results of the AddData operation on x, a signature comparison identification engine configured to identify an operation within the application that compares the results of the Sign operation with another value.
摘要翻译：一种用于在测试计算机软件时消除安全漏洞的虚假报告的系统，包括配置成识别计算机应用程序中的受污染变量v的污染分析引擎，配置为识别应用程序内的变量x，该变量x保存从 v，其中x与v不同的格式，被配置为识别在x上执行的应用程序内的AddData操作的AddData识别引擎，被配置为识别在结果上执行的应用程序内的签名操作的签名识别引擎的签名比较识别引擎，所述签名比较识别引擎被配置为识别应用程序内将所述Sign操作的结果与另一值进行比较的操作。

9. 发明授权

US09275246B2 System and method for static detection and categorization of information-flow downgraders 有权
标题翻译：信息流降级的静态检测和分类的系统和方法
公开(公告)号：US09275246B2
公开(公告)日：2016-03-01
申请号：US12575647
申请日：2009-10-08
申请人： Yinnon Haviv , Roee Hay , Marco Pistoia , Guy Podjarny , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon Haviv , Roee Hay , Marco Pistoia , Guy Podjarny , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F17/30 , G06F7/00 , G06F21/62 , G06F9/45 , G06F11/36
CPC分类号： H04L63/1416 , G06F8/49 , G06F11/3608 , G06F21/6218
摘要： A system and method for static detection and categorization of information-flow downgraders includes transforming a program stored in a memory device by statically analyzing program variables to yield a single assignment to each variable in an instruction set. The instruction set is translated to production rules with string operations. A context-free grammar is generated from the production rules to identify a finite set of strings. An information-flow downgrader function is identified by checking the finite set of strings against one or more function specifications.
摘要翻译：用于信息流降级器的静态检测和分类的系统和方法包括通过静态分析程序变量来变换存储在存储器件中的程序，以产生对指令集中的每个变量的单个赋值。指令集被转换为具有字符串操作的生产规则。从生产规则生成上下文无关的语法，以识别有限的字符串集。通过根据一个或多个功能规范检查有限的字符串来识别信息流降级功能。

10. 发明授权

US08635602B2 Verification of information-flow downgraders 失效
标题翻译：验证信息流下载
公开(公告)号：US08635602B2
公开(公告)日：2014-01-21
申请号：US12843308
申请日：2010-07-26
申请人： Yinnon Avraham Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
发明人： Yinnon Avraham Haviv , Roee Hay , Marco Pistoia , Adi Sharabani , Takaaki Tateishi , Omer Tripp , Omri Weisman
IPC分类号： G06F9/44
CPC分类号： G06F21/577 , H04L63/105
摘要： A method includes determining grammar for output of an information-flow downgrader in a software program. The software program directs the output of the information-flow downgrader to a sink. The method includes determining whether the grammar of the output conforms to one or more predetermined specifications of the sink. The method includes, in response to a determination the grammar of the output conforms to the one or more predetermined specifications of the sink, determining the information-flow downgrader is verified for the sink, wherein determining grammar, determining whether the grammar, and determining the information-flow downgrader are performed via static analysis of the software program. Apparatus and computer program products are also disclosed. An apparatus includes a user interface providing a result of whether or not output of an information-flow downgrader in the software program conforms to one or more predetermined specifications of a sink in the software program.
摘要翻译：一种方法包括在软件程序中确定信息流降级器的输出的语法。软件程序将信息流降级器的输出引导到宿。该方法包括确定输出的语法是否符合汇的一个或多个预定规范。该方法包括响应于确定，输出的语法符合信宿的一个或多个预定规范，确定信宿流降级器对于汇点进行验证，其中确定语法，确定语法，并确定信息流降级器通过软件程序的静态分析来执行。还公开了装置和计算机程序产品。一种装置，包括提供软件程序中的信息流下载器的输出是否符合软件程序中的接收器的一个或多个预定规格的结果的用户界面。

你已经成功收藏专利！

检索式保存成功!

IPRDB

热门服务

关于我们

友情链接

联系方式