# US 10,310,962 B2 · Infrastructure rule generation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,310,962 B2
- Document ID: US10310962B2
- Status: Granted
- Kind: B2
- Application number: 15/500,522
- Filed: 2014-09-24
- Published: 2017-08-03
- Granted: 2019-06-04
- Earliest claimed: 2014-09-24
- Assignees: Entit Software LLC
- Applicants: Entit Software LLC
- Inventors: Alvaro Munoz Sanchez; Yekaterina Tsipenyuk O'Neil
- Web page: https://patentgrep.com/patent/US10310962B2

## CPC

- G06F 11/3636: {by tracing the execution of the program}
- G06F 11/30: Monitoring
- G06F 11/3466: {Performance evaluation by tracing or monitoring}
- G06F 11/3612: {by runtime analysis (performance monitoring G06F11/3466)}
- G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow}
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

In one implementation, a system can comprise a probe monitor engine to monitor a probe passed to a function of a set of instructions, a propagation engine to identify an infrastructure connection based on an attribute of the probe during a runtime session, and a rule engine to generate an infrastructure rule based on the infrastructure connection and the attribute of the probe.

## Claims

### Claim 1

A system comprising:
a processor; and
a non-transitory storage medium storing instructions executable on the processor to:
receive information of a probe passed to a function of a set of instructions, the probe having a predetermined value;
identify an infrastructure connection based on an attribute of the probe during a runtime session, the set of instructions to execute during the runtime session, the infrastructure connection comprising a connection from a first program code of the set of instructions to a second program code based on monitoring information from the probe as the probe propagates during the execution of the set of instructions, the information monitored based on an exchange of data between a first set of instructions and a second set of instructions;
generate an infrastructure rule based on the infrastructure connection and the attribute of the probe; and
provide the infrastructure rule to a static analysis tool for use in a static analysis of the set of instructions by the static analysis tool.

### Claim 2 (depends on 1)

The system of claim 1, wherein the instructions are executable on the processor to:
identify an entry point and a propagation flow based on a location and a modification of the probe during the runtime session;
send the probe to a scanner; and
generate a source rule associated with the entry point and a pass-through rule associated with the propagation flow based on how the probe is reflected in a function slot.

### Claim 3 (depends on 2)

The system of claim 2, wherein:
the set of instructions is a third party library linked to an application executable during the runtime session;
the infrastructure rule is one of the source rule and the pass-through rule; and
the function slot is one of an instance object, an argument, and a return value.

### Claim 4 (depends on 1)

The system of claim 1, wherein the instructions are executable on the processor to:
cause a call stack trace associated with the runtime session; and
identify a location in the set of instructions where the probe appears as the probe propagates during execution of the set of instructions.

### Claim 5 (depends on 1)

The system of claim 1, wherein the instructions are executable on the processor to:
cause a stack trace associated with the second program code during the runtime session; and
produce a file comprising a plurality of rules to identify a static analysis dataflow based on a monitored stack trace and a level of false result likelihood, the infrastructure rule comprising a first rule of the plurality of rules and the file compatible with the static analyzer.

### Claim 6 (depends on 1)

The system of claim 1, wherein the infrastructure rule comprises a source rule associated with the function producing tainted data, and a pass-through rule associated with transfer of the tainted data.

### Claim 7 (depends on 6)

The system of claim 6, wherein the pass-through rule identifies the function and describes how data is passed to a return slot of the function.

### Claim 8

A non-transitory computer readable storage medium comprising instructions executable by one or more processors to:
cause a first program code to execute with a probe as input, the first program code linked to a second program code and the probe comprising a unique value;
receive monitored information from the probe during a runtime session of the first program code, the monitored information based on an exchange of data between a first set of instructions and a second set of instructions, as the probe propagates during tine execution of the first program code;
identify an infrastructure connection between the first program code and the second program code based on the monitored information from the probe; and
generate an infrastructure rule associated with the second program code based on the infrastructure connection and the monitored information from the probe,
wherein generating the infrastructure rule comprises determining the infrastructure rule based on a first reflection of the probe at a function slot the probe comprising a predetermined string prepared as probe argument.

### Claim 9 (depends on 8)

The non-transitory computer readable storage medium of claim 8, wherein:
the first reflection is one of a total reflection of the probe argument, a subset of the probe argument, and a superset comprising the probe argument;
the function slot is an interceptable point of a function to provide the unique value of the probe; and
the infrastructure rule is a pass-through rule to describe the infrastructure interconnection between the first program code and the second program code.

### Claim 10 (depends on 8)

The non-transitory computer readable storage medium of claim 8, wherein generating the infrastructure rule comprises:
comparing the infrastructure connection to a mapping of a plurality of probe reflections to a plurality of static analysis rules, the first reflection being one of the plurality of probe reflections;
selecting a first static analysis rule of the plurality of static analysis rules based on the first reflection; and
modifying the first static analysis rule based on the infrastructure connection.

### Claim 11

A method executed by one or more hardware processors to implement a process of analyzing code, comprising:
receiving monitor information of a probe based on an exchange of data between a first set of instructions and a second set of instructions as the probe propagates during an execution of a program, wherein receiving the monitor information of the probe comprises causing a scanner to gather probe data from the probe at a function slot;
identifying a connection based on the exchange of the data, wherein identifying the connection comprises modeling an infrastructure of the first set of instructions and the second set of instructions;
identifying a reflection of the probe, the reflection comprising a difference between a first state of the probe as an input argument and a second state of the probe as an output argument, wherein the probe data includes the reflection of the probe, and identifying the reflection comprises modeling a dataflow of the second set of instructions;
generating an infrastructure rule based on the connection and the reflection; and providing the infrastructure rule to a static analysis tool for use in a static analysis of the first set of instructions by the static analysis tool.

### Claim 12 (depends on 11)

The method of claim 11, comprising:
requesting an agent to execute a runtime test of the second set of instructions;
causing execution of the first set of instructions with the probe as an argument, the probe comprising a unique value;
causing the agent to analyze a communication from a scanner to produce the monitor information based on the exchange of data; and
providing the infrastructure rule to a static analyzer.

### Claim 13 (depends on 11)

The method of claim 11, comprising:
causing a stack trace associated with the second set of instructions during a runtime session; and
producing a file comprising a plurality of rules to identify a static analysis dataflow based on a monitored stack trace and a level of false result likelihood, the infrastructure rule comprising a first rule of the plurality of rules and the file compatible with the static analyzer.

### Claim 14

A method executed by one or more hardware processors to implement a process of analyzing code, comprising:
receiving monitor information of a probe based on an exchange of data between a first set of instructions and a second set of instructions as the probe propagates during an execution of a program;
identifying a connection based on the exchange of the data;
identifying a reflection of the probe, the reflection being a difference between a first state of the probe as an input argument and a second state of the probe as an output argument;
generating an infrastructure rule based on the connection and the reflection;
requesting an agent to execute a runtime test of the second set of instructions;
causing execution of the first set of instructions with the probe as an argument;
causing the agent to analyze a communication from a scanner to produce the monitor information based on the exchange of data; and
providing the infrastructure rule to a static analyzer to perform a static analysis of the first set of instructions, wherein identifying the connection and identifying the reflection of the probe arc performed by the agent, the probe comprising a cyclic pattern, and the reflection describing a location of the difference between the first state and the second state.

### Claim 15 (depends on 14)

The method of claim 14, wherein:
receiving the monitor information of the probe comprises causing the scanner to gather probe data from the probe at a function slot, the probe data including the reflection of the probe; and
identifying the connection comprises modeling an infrastructure of the first set of instructions and the second set of instructions; and
identifying the reflection comprises modeling a dataflow of the second set of instructions.

### Claim 16

A non-transitory computer readable storage medium comprising instructions executable by a one or more processors to:
receive monitor information of a probe based on an exchange of data between a first set of instructions and a second set of instructions as the probe propagates during an execution of a program;
identify a connection based on the exchange of the data;
identify a reflection of the probe, the reflection being a difference between a first state of the probe as an input argument and a second state of the probe as an output argument;
generate an infrastructure rule based on the connection and the reflection, wherein generating the infrastructure rule comprises: mapping the connection to a template pass-through rule; and customizing the template pass-through rule based on the reflection; and
provide the infrastructure rule to a static analysis tool for use in a static analysis of the first set of instructions by the static analysis tool.