# US 2014/0157419 A1 · Discovery of application vulnerabilities involving multiple execution flows > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157419 A1 - Document ID: US20140157419A1 - Status: Published application - Kind: A1 - Application number: 13/705,799 - Filed: 2012-12-05 - Published: 2014-06-05 - Earliest claimed: 2012-12-05 - Assignees: International Business Machines Corporation - Applicants: International Business Machines Corp - Inventors: SALVATORE A. GUARNIERI; MARCO PISTOIA; OMER TRIPP - Web page: https://patentgrep.com/patent/US20140157419A1 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/562: {Static detection} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and systems for security analysis of an application are disclosed. In accordance with one method, a flow-insensitive analysis is conducted on the application to obtain a set of potential vulnerabilities in the application. For each of the potential vulnerabilities, a relevant set of control flows that include the respective vulnerability is determined. Further, for each relevant set of control flows, a flow-sensitive analysis of at least one of the control flows in the corresponding relevant set is performed by a hardware processor to assess the validity of the respective vulnerability. ## Claims ### Claim at position 1 -25. (canceled) ### Claim 26 A method for security analysis of an application comprising: conducting a flow-insensitive analysis on the application to obtain a set of potential vulnerabilities in the application; for each of the potential vulnerabilities, determining a relevant set of control flows that include the respective vulnerability; and for each relevant set of control flows, performing, by a hardware processor, a flow-sensitive analysis of at least one of the control flows in the corresponding relevant set to assess a validity of the respective vulnerability. ### Claim 27 (depends on 26) The method of claim 26, wherein the performing the flow-sensitive analysis further comprises performing the flow sensitive analysis on a concatenation of control flows in at least one of the relevant sets. ### Claim 28 (depends on 27) The method of claim 27, wherein a plurality of the control flows in the concatenation denote multiple executions of the application. ### Claim 29 (depends on 28) The method of claim 28, wherein the multiple executions denote separate interactions with a user. ### Claim 30 (depends on 29) The method of claim 29, wherein the application is a parallel program web application. ### Claim 31 (depends on 26) The method of claim 26, wherein the determining the relevant set of control flows that include the respective vulnerability further comprises determining a set of control flows that enable source to sink data propagation. ### Claim 32 (depends on 26) The method of claim 26, further comprising: for each of the vulnerabilities, determining whether the respective vulnerability is reproduced by the flow-sensitive analysis. ### Claim 33 (depends on 32) The method of claim 32, further comprising: outputting a report denoting each of the respective vulnerabilities that are reproduced by the flow-sensitive analysis. ### Claim 34 A method for security analysis of a web application comprising: conducting a flow-insensitive analysis on the application to obtain a set of potential witnesses of vulnerabilities in the application; for each of the potential witnesses, restricting a scope of analysis within program code of the application to a relevant set of control flows; and for at least one of the relevant sets of control flows, performing, by a hardware processor, a flow-sensitive analysis of a concatenation of the control flows in the corresponding relevant set to assess a validity of the respective witness across multiple executions of the web application. ### Claim 35 (depends on 34) The method of claim 34, wherein a plurality of the control flows in the concatenation denote the multiple executions of the web application. ### Claim 36 (depends on 35) The method of claim 35, wherein the multiple executions denote separate interactions with a user. ### Claim 37 (depends on 34) The method of claim 34, wherein the restricting the scope of analysis further comprises determining a set of control flows that enable source to sink data propagation. ### Claim 38 (depends on 34) The method of claim 34, further comprising: for each of the witnesses, determining whether the respective witness is reproduced by the flow-sensitive analysis. ### Claim 39 (depends on 38) The method of claim 38, further comprising: outputting a report denoting each of the respective witnesses that are reproduced by the flow-sensitive analysis. ### Claim 40 A method for security analysis of an application comprising: conducting a flow-insensitive analysis on the application to obtain a set of potential vulnerabilities in the application; for at least one of the potential vulnerabilities, determining a relevant sequence of control flows that enable source to sink data propagation; and for at least one relevant sequence of control flows, performing, by a hardware processor, a flow-sensitive analysis of a concatenation of a plurality of control flows in the corresponding relevant sequence to assess a validity of the respective vulnerability. ### Claim 41 (depends on 40) The method of claim 40, wherein a plurality of the control flows in the concatenation denote multiple executions of the application. ### Claim 42 (depends on 41) The method of claim 41, wherein the multiple executions denote separate interactions with a user. ### Claim 43 (depends on 42) The method of claim 42, wherein the application is a parallel program web application. ### Claim 44 (depends on 40) The method of claim 40, further comprising: for each of the vulnerabilities, determining whether the respective vulnerability is reproduced by the flow-sensitive analysis. ### Claim 45 (depends on 44) The method of claim 44, further comprising: outputting a report denoting each of the respective vulnerabilities that are reproduced by the flow-sensitive analysis.