System and method for static detection and categorization of information-flow downgraders

A computer readable storage medium comprising a computer readable program for static detection and categorization of information-flow downgraders, wherein the computer readable program when executed on a computer causes the computer to perform the steps of:

• transforming a program stored in a memory device by statically analyzing program variables to yield a single assignment to each variable in an instruction set;
• translating the instruction set to production rules with string operations;
• generating a context-free grammar from the production rules to identify a finite set of strings;
• and
• identifying an information-flow downgrader function by checking the finite set of strings against one or more function specifications.

A method for static detection and categorization of information-flow downgraders, comprising:

• transforming a program stored in a memory device by statically analyzing program variables to yield a single assignment to each variable in an instruction set;
• translating the instruction set to production rules with string operations;
• performing a pointer analysis on the production rules with string operations to improve precision;
• generating a context-free grammar from the production rules to identify a finite set of strings;
• comparing the context free grammar with a specification of a security-sensitive function such that if the grammar satisfies the specification the input is considered properly downgraded;
• and
• labeling a string to locate string-manipulating functions that modified an input and made the input specification-compliant to identify and categorize an information-flow downgrader function.

A system for static detection and categorization of information-flow downgraders, comprising:

• a program storage device configured to store a program, the program storage device further configured to work in conjunction with a processor to execute program instructions to detect and categorize information-flow downgraders in the program;
• a static analysis framework configured to analyze an application program and to perform a static string assignment on the application program to transform program variables to yield a single assignment for each variable in an instruction set, the framework configured to translate the instruction set to production rules with string operations and generate a context-free grammar from the production rules to identify a finite set of strings;
• and
• a comparison module configured to detect and categorize the finite set of strings by comparing the finite set of strings against one or more function specifications to identify an information-flow downgrader function.