# US 2014/0157420 A1 · Discovery of application vulnerabilities involving multiple execution flows > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157420 A1 - Document ID: US20140157420A1 - Status: Published application - Kind: A1 - Application number: 13/755,151 - Filed: 2013-01-31 - Published: 2014-06-05 - Earliest claimed: 2012-12-05 - Assignees: International Business Machines Corporation - Inventors: SALVATORE A. GUARNIERI; MARCO PISTOIA; OMER TRIPP - Web page: https://patentgrep.com/patent/US20140157420A1 ## CPC - G06F 21/577: {Assessing vulnerabilities and evaluating computer system security} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 21/562: {Static detection} - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Methods and systems for security analysis of an application are disclosed. One system includes a flow-insensitive analyzer, a control flow assessment module and a flow-sensitive analyzer. The flow-insensitive analyzer is configured to conduct a flow-insensitive analysis on the application to obtain a set of potential vulnerabilities in the application. In addition, the control flow assessment module is configured to determine, for each of the potential vulnerabilities, a relevant set of control flows that include the respective vulnerability. Further, the flow-sensitive analyzer is configured to perform, by a hardware processor, for each relevant set of control flows, a flow-sensitive analysis of at least one of the control flows in the corresponding relevant set to assess the validity of the respective vulnerability. ## Claims ### Claim 1 A system for security analysis of an application comprising: a flow-insensitive analyzer configured to conduct a flow-insensitive analysis on the application to obtain a set of potential vulnerabilities in the application; a control flow assessment module configured to determine, for each of the potential vulnerabilities, a relevant set of control flows that include the respective vulnerability; and a flow-sensitive analyzer configured to perform, by a hardware processor, for each relevant set of control flows, a flow-sensitive analysis of at least one of the control flows in the corresponding relevant set to assess a validity of the respective vulnerability. ### Claim 2 (depends on 1) The system of claim 1, wherein flow-sensitive analyzer is configured to perform the flow sensitive analysis on a concatenation of control flows in at least one of the relevant sets. ### Claim 3 (depends on 2) The system of claim 2, wherein a plurality of the control flows in the concatenation denote multiple executions of the application. ### Claim 4 (depends on 3) The system of claim 3, wherein the multiple executions denote separate interactions with a user. ### Claim 5 (depends on 4) The system of claim 4, wherein the application is a parallel program web application. ### Claim 6 (depends on 1) The system of claim 1, wherein the control flow assessment module is configured to determine a set of control flows that enable source to sink data propagation. ### Claim 7 (depends on 1) The system of claim 1, further comprising: a controller configured to determine, for each of the vulnerabilities, whether the respective vulnerability is reproduced by the flow sensitive analysis. ### Claim 8 (depends on 7) The system of claim 7, wherein the controller is further configured to output a report denoting each of the respective vulnerabilities that are reproduced by the flow sensitive analysis. ### Claim 9 A computer readable storage medium comprising a computer readable program for security analysis of a web application, wherein the computer readable program when executed on a computer causes the computer to perform the steps of: conducting a flow-insensitive analysis on the application to obtain a set of potential witnesses of vulnerabilities in the application; for each of the potential witnesses, restricting a scope of analysis within program code of the application to a relevant set of control flows; and for at least one of the relevant sets of control flows, performing a flow-sensitive analysis of a concatenation of the control flows in the corresponding relevant set to assess a validity of the respective witness across multiple executions of the web application. ### Claim 10 (depends on 9) The computer readable storage medium of claim 9, wherein a plurality of the control flows in the concatenation denote the multiple executions of the web application. ### Claim 11 (depends on 10) The computer readable storage medium of claim 10, wherein the multiple executions denote separate interactions with a user. ### Claim 12 (depends on 9) The computer readable storage medium of claim 9, wherein the restricting the scope of analysis further comprises determining a set of control flows that enable source to sink data propagation. ### Claim 13 (depends on 9) The computer readable storage medium of claim 9, wherein the steps further comprise: for each of the witnesses, determining whether the respective witness is reproduced by the flow-sensitive analysis. ### Claim 14 (depends on 13) The computer readable storage medium of claim 13, wherein the steps further comprise: outputting a report denoting each of the respective witnesses that are reproduced by the flow sensitive analysis. ### Claim 15 A system for security analysis of an application comprising: a flow-insensitive analyzer configured to conduct a flow-insensitive analysis on the application to obtain a set of potential vulnerabilities in the application; a control flow assessment module configured to determine, for at least one of the potential vulnerabilities, a relevant sequence of control flows that enable source to sink data propagation; and a flow-insensitive analyzer configured to perform, by a hardware processor, for at least one relevant sequence of control flows, a flow-sensitive analysis of a concatenation of a plurality of control flows in the corresponding relevant sequence to assess a validity of the respective vulnerability. ### Claim 16 (depends on 15) The system of claim 15, wherein a plurality of the control flows in the concatenation denote multiple executions of the application. ### Claim 17 (depends on 16) The system of claim 16, wherein the multiple executions denote separate interactions with a user. ### Claim 18 (depends on 17) The system of claim 17, wherein the application is a parallel program web application. ### Claim 19 (depends on 15) The system of claim 15, further comprising: a controller configured to determine, for each of the vulnerabilities, whether the respective vulnerability is reproduced by the flow sensitive analysis. ### Claim 20 (depends on 19) The system of claim 19, wherein the controller is further configured to output a report denoting each of the respective vulnerabilities that are reproduced by the flow-sensitive analysis.