System and methods for automated detection of input and output validation and resource management vulnerability
AssigneeVirsec Systems, Inc.
InventorSatya Vrat Gupta
Life of this patent
Estimating the term…
Abstract
In an example embodiment, a system analyzes a set of computer routines. The system may perform an analysis including a determination of a likelihood of vulnerability to unexpected behavior for one or more computer routines of the set. Based upon the analysis, the system may identify one or more computer routines of the set having the likelihood of vulnerability. The system may asynchronously and dynamically manipulate at least one of the one or more computer routines through a testing technique. The system may determine unexpected behavior of at least one of the one or more computer routines.
Claims18
A computer-implemented method for determining unexpected behavior of a computer routine, the method comprising:
- analyzing a set of computer routines to identify a given computer routine of the set of computer routines having a vulnerability to unexpected behavior wherein, the identifying includes determining functions and system call sequences used by each thread associated with the set of computer routines to map run time control flow of the set of computer routines and the analysis includes at least one of:
- (i) performing a simulation to cause at least one failure condition and observing response of at least one computer routine of the set of computer routines to the simulation, (ii) extracting a histogram including a frequency of usage associated with the set of computer routines, (iii) determining size of one or more buffer read or write computer operations associated with the set of computer routines, (iv) determining size of one or more corresponding stacks associated with the set of computer routines, (v) determining size of one or more memory read or write operations based upon examining a corresponding loop size, and (vi) performing a taint analysis of one or more computer routine of the set;
- manipulating the given computer routine using a testing technique;
- and
- determining unexpected behavior of the given computer routine based on a result of the manipulating.
A system for determining unexpected behavior of a computer routine, the system comprising:
- a processor;
- and
- a memory with computer code instructions stored thereon, the processor and the memory, with the computer code instructions, being configured to cause the system to:
- analyze a set of computer routines to identify a given computer routine of the set of computer routines having a vulnerability to unexpected behavior wherein, the identifying includes determining functions and system call sequences used by each thread associated with the set of computer routines to map run time control flow of the set of computer routines and the analysis includes at least one of:
- (i) performing a simulation to cause at least one failure condition and observing response of at least one computer routine of the set of computer routines to the simulation, (ii) extracting a histogram including a frequency of usage associated with the set of computer routines, (iii) determining size of one or more buffer read or write computer operations associated with the set of computer routines, (iv) determining size of one or more corresponding stacks associated with the set of computer routines, (v) determining size of one or more memory read or write operations based upon examining a corresponding loop size, and (vi) performing a taint analysis of one or more computer routine of the set;
- manipulate the given computer routine using a testing technique;
- and
- determine unexpected behavior of the given computer routine based on a result of the manipulating.
A non-transitory computer program product for determining unexpected behavior of a computer routine, the computer program product comprising a computer-readable medium with computer code instructions stored thereon, the computer code instructions being configured, when executed by a processor, to cause an apparatus associated with the processor to:
- analyze a set of computer routines to identify a given computer routine of the set of computer routines having a vulnerability to unexpected behavior wherein, the identifying includes determining functions and system call sequences used by each thread associated with the set of computer routines to map run time control flow of the set of computer routines and the analysis includes at least one of:
- (i) performing a simulation to cause at least one failure condition and observing response of at least one computer routine of the set of computer routines to the simulation, (ii) extracting a histogram including a frequency of usage associated with the set of computer routines, (iii) determining size of one or more buffer read or write computer operations associated with the set of computer routines, (iv) determining size of one or more corresponding stacks associated with the set of computer routines, (v) determining size of one or more memory read or write operations based upon examining a corresponding loop size, and (vi) performing a taint analysis of one or more computer routine of the set;
- manipulate the given computer routine using a testing technique;
- and
- determine unexpected behavior of the given computer routine based on a result of the manipulating.
Dependencies are inferred from the claim text.