Automatic inference of whitelist-based validation as part of static analysis for security
US8627465B2 · kind B2 · utility
Assignee
Inventors
Key dates
| Filing date | Apr 18, 2011 |
| Grant date | Jan 7, 2014 |
| Priority date | — |
| Expiry date | Dec 26, 2031 |
Classification
- Technology area (CPC G)Physics
- CPC primaryG06F2221/033
- WIPO fieldComputer technology
- WIPO sectorElectrical engineering
Abstract
A method includes performing taint analysis of a computer program and determining an original set of paths from sources to sinks. Each path corresponds to a vulnerability. The method includes determining for each variable whose type is a collection and is accessed in one of the paths in the original set of paths whether the variable points to a concrete value whose internal state is not tainted according to the taint analysis. The method further includes, for each of the variables whose type is a collection found not to be tainted according to the taint analysis, determining all points in the computer program where a membership check against the collection is performed. The method also includes, for each of the points, determining corresponding paths and removing those paths from the original set of paths to create a reduced set of paths. Apparatus and computer readable program products are also disclosed.
Source: USPTO / EPO open patent data. Objective bibliographic and citation counts.