# US 2014/0157418 A1 · Detecting security vulnerabilities on computing devices

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0157418 A1
- Document ID: US20140157418A1
- Status: Published application
- Kind: A1
- Application number: 13/705,705
- Filed: 2012-12-05
- Published: 2014-06-05
- Earliest claimed: 2012-12-05
- Assignees: International Business Machines Corporation
- Applicants: International Business Machines Corporation
- Inventors: ROEE HAY; DANIEL KALMAN; ROI SALTZMAN; OMER TRIPP
- Web page: https://patentgrep.com/patent/US20140157418A1

## CPC

- G06F 21/577: {Assessing vulnerabilities and evaluating computer system security}
- G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow}
- G06F 21/554: {involving event detection and direct action}
- G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities}
- G06F 21/606: {by securing the transmission between two devices or processes}
- G06F 21/62: Protecting access to data via a platform, e.g. using keys or access control rules
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Identifying security vulnerabilities on computing devices by detecting an inter-process communication on a computing device, determining whether the inter-process communication is consistent with a predefined specification of a security vulnerability, and causing a predefined action to be performed on the computing device responsive to determining that the inter-process communication is consistent with a predefined specification of a security vulnerability.

## Claims

### Claim at position 1

1-8. (canceled)

### Claim 9

A system for identifying security vulnerabilities on computing devices, the system comprising:
a processor programmed to initiate executable operations comprising:
detecting an inter-process communication on a computing device;
determining whether the inter-process communication is consistent with a predefined specification of a security vulnerability; and
causing a predefined action to be performed on the computing device responsive to determining that the inter-process communication is consistent with a predefined specification of a security vulnerability, wherein
the determining comprises determining where the security vulnerability is a susceptibility to a confidentiality violation.

### Claim 10 (depends on 9)

The system according to claim 9 wherein
the detecting comprises receiving broadcast-type inter-process communications.

### Claim 11 (depends on 9)

The system according to claim 9 wherein
the detecting comprises indicating an ability to receive inter-process communications of a predefined type.

### Claim at position 5

12-13. (canceled)

### Claim 14 (depends on 9)

The system according to claim 9 wherein
the causing step comprises causing a notification to be provided to a user of the computing device describing the security vulnerability.

### Claim 15 (depends on 9)

The system according to claim 9 wherein
the causing step comprises causing an issuer of the inter-process communication to be terminated or quarantined.

### Claim 16 (depends on 9)

The system of claim 9 wherein
the detecting, communication and causing are embodied in and implemented by any of
a) computer hardware, and
b) computer software embodied in a non-transitory, computer-readable medium.

### Claim 17

A computer program product for identifying security vulnerabilities on computing devices, the computer program product comprising:
a computer-readable storage medium having stored therein computer-readable program code, which when executed by a computer hardware system, causes the computer hardware system to perform
detecting an inter-process communication on a computing device;
determining whether the inter-process communication is consistent with a predefined specification of a security vulnerability; and
causing a predefined action to be performed on the computing device responsive to determining that the inter-process communication is consistent with a predefined specification of a security vulnerability, wherein
the computer-readable storage medium is not a transitory, propagating signal per se, and
the determining comprises determining where the security vulnerability is a susceptibility to a confidentiality violation.

### Claim 18 (depends on 17)

The computer program product according to claim 17, wherein the computer-readable program code further causes the computer hardware system to perform
receiving broadcast-type inter-process communications.

### Claim 19 (depends on 17)

The computer program product according to claim 17, wherein the computer-readable program code further causes the computer hardware system to perform
indicating an ability to receive inter-process communications of a predefined type.

### Claim at position 12

20-21. (canceled)

### Claim 22 (depends on 17)

The computer program product according to claim 17, wherein the computer-readable program code further causes the computer hardware system to perform
causing a notification to be provided to a user of the computing device describing the security vulnerability.

### Claim 23 (depends on 17)

The computer program product according to claim 17, wherein the computer-readable program code further causes the computer hardware system to perform
causing an issuer of the inter-process communication to be terminated or quarantined.

### Claim 24 (depends on 9)

The system according to claim 9 wherein
the inter-process communication is between two known applications.

### Claim 25 (depends on 17)

The computer program product according to claim 17, wherein
the inter-process communication is between two known applications.