Efficient and comprehensive source code fuzzing
AssigneeCyberArk Software Ltd.
InventorsZe'ev Ben Porath, Kasif Dekel
Life of this patent
Estimating the term…
Abstract
Disclosed embodiments relate to exposing potential vulnerabilities in software programs. Techniques include referencing a software vulnerability assessment program, and modifying source code of a tested software program with native language commands. Techniques also include testing the modified software program, analyzing tracked executed code sections of output data to identify one or more current barriers in the tested software program, generating new input data for the tested software program configured to cross one or more current barriers, and merging the new generated input data with a dataset that is being tested by the software vulnerability assessment program.
Claims20
A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for exposing potential vulnerabilities in software programs, the operations comprising:
- referencing a software vulnerability assessment program configured to:
- execute a tested software program;
- and
- apply, via the execution, random changes to input data for the tested software program;
- modifying the source code of the tested software program with a native language command, without changing the functional behavior of the tested software program, in order to:
- track executed code sections of the tested software program;
- and
- generate output data with the tracked executed code sections;
- executing the software vulnerability assessment program to test the modified tested software program;
- analyzing the tracked executed code sections of the output data, generated during the execution of vulnerability assessment program, to identify one or more current barriers in the tested software program, wherein the one or more current barriers comprise an executed code section of the tested software program and an unexecuted code section of the tested software program;
- generating new input data for the tested software program configured to cross the one or more current barriers;
- and
- merging the new generated input data with a dataset that is being tested by the software vulnerability assessment program.
A non-transitory computer readable medium including instructions that, when executed by at least one processor, cause the at least one processor to perform operations for exposing potential vulnerabilities in software programs, the operations comprising:
- analyzing source code of a tested software program using language processing;
- identifying one or more current barriers in the tested software program, each barrier having a start condition and an end condition;
- and inserting, into the source code, a command before the start condition and the end condition of each of the one or more barriers;
- where utilization of the barriers in configuring vulnerabilities test and corresponding input dataset includes:
- applying, via execution of the tested target program by a vulnerabilities assessment software, random changes to input data for the tested software program;
- modifying the source code of the tested software program with a native language command, without changing the functional behavior of the tested software program, in order to:
- track executed code sections of the tested software program;
- and
- generate output data with the tracked executed code sections;
- executing the software vulnerability assessment program to test the modified software program;
- and analyzing the tracked executed code sections of the output data, generated during the execution of vulnerability assessment program, to identify one or more current barriers in the tested software program,
- wherein the one or more current barriers comprise an executed code section of the tested software program and an unexecuted code section of the tested software program;
- generating new input data for the tested software program configured to cross the one or more current barriers;
- and merging the new generated data with the dataset that is being tested by the vulnerabilities assessment program.
A computer-implemented method for exposing potential vulnerabilities in software programs, the method comprising:
- referencing a software vulnerability assessment program configured to:
- execute a tested software program;
- and
- apply, via the execution, random changes to input data for the tested software program;
- modifying the source code of the tested software program with a native language command, without changing the functional behavior of the tested software program, in order to:
- track executed code sections of the tested software program;
- and
- generate output data with the tracked executed code sections;
- executing the software vulnerability assessment program to test the modified software program;
- analyzing the tracked executed code sections of the output data, generated during the execution of vulnerability assessment program, to identify one or more current barriers in the tested software program, wherein the one or more current barriers comprise an executed code section of the tested software program and an unexecuted code section of the tested software program;
- generating new input data for the tested software program configured to cross the one or more current barriers;
- and
- merging the new generated input data with a dataset that is being tested by the software vulnerability assessment program.
Dependencies are inferred from the claim text.