Methods, systems and computer readable media for detecting command injection attacks
AssigneeUniversity of Virginia Patent Foundation
InventorsAnh Nguyen-Tuong, Jack W. Davidson, Michele Co, Jason D. Hiser, John C. Knight
Life of this patent
Estimating the term…
Abstract
Methods and systems are described for detecting command injection attacks. A positive, taint inference method includes receiving signature fragments on one hand, converting command injection instructions into command fragments on another hand, thus identifying potential attacks upon the condition that a command injection instruction includes critical untrusted parts by using signature fragments. A system detects command injection attacks using this kind of method, and remediates and rejects potential attacks.
Claims69
A computer method for detecting command injection attacks, said method comprising:
- receiving software code;
- extracting string fragments from said received software code to provide extracted signature fragments;
- receiving command instructions;
- converting the received command instructions into command fragments;
- identifying critical parts from said command fragments;
- determining if said critical parts are untrusted or trusted by matching with said extracted signature fragments;
- identifying potential attacks upon the condition that a command includes critical parts that are untrusted;
- and
- communicating said identification of potential attacks to an output device, wherein the command fragments are different from external data processed by the software code, and the critical parts of the command fragments do not originate from previously identified command fragments.
A computer method for detecting command injection attacks, said method comprising:
- receiving software code;
- receiving string fragments to provide signature fragments;
- receiving command instructions;
- converting the received command instructions into command fragments;
- identifying critical parts from said command fragments;
- determining untrusted or trusted parts of the command instructions by using said signature fragments;
- identifying potential attacks upon the condition that a command includes critical parts that are untrusted;
- and
- communicating said identification of potential attacks to an output device, wherein the command fragments are different from external data processed by the software code, and the critical parts of the command fragments do not originate from previously identified command fragments.
A non-transitory computer readable medium including instructions executable by a processor for detecting command injection attacks, said instructions comprising:
- receiving software code;
- extracting string fragments from said received software code to provide extracted signature fragments;
- receiving command instructions;
- converting the received command instructions into command fragments;
- identifying critical parts from said command fragments;
- determining if said critical parts are untrusted or trusted by matching with said extracted signature fragments;
- identifying potential attacks upon the condition that a command includes critical parts that are untrusted;
- and
- communicating said identification of potential attacks to an output device, wherein the command fragments are different from external data processed by the software code, and the critical parts of the command fragments do not originate from previously identified command fragments.
A non-transitory computer readable medium including instructions executable by a processor for detecting command injection attacks, said instructions comprising:
- receiving software code;
- receiving string fragments to provide signature fragments;
- receiving command instructions;
- converting the received command instructions into command fragments;
- identifying critical parts from said command fragments;
- determining untrusted or trusted parts of the command instructions by using said signature fragments;
- identifying potential attacks upon the condition that a command includes critical parts that are untrusted;
- and
- communicating said identification of potential attacks to an output device, wherein the command fragments are different from external data processed by the software code, and the critical parts of the command fragments do not originate from previously identified command fragments.
Dependencies are inferred from the claim text.