US 8,479,188 B2 · Binary code change vulnerability prioritization

Abstract

A human-readable list of patch differences ranked by weight helps vulnerability analysts allocate their time. From binary code, identified source functions and recognized sink functions are used when assigning relative weights to changes caused by a patch. Source functions are identified using an export table, import table, and remote procedure call interface. Sink functions are recognized using blacklisted functions, patch-targeted functions, memory functions, string functions, and functions called with mismatched parameters. A change prioritizer assigns weights based on an architectural graph and a set of prioritization rules that specify what kind of change is made by a patch, and what kind of function is changed. Weight assignments may be additive. Rules may assign certain kinds of change a higher priority for subsequent scrutiny by an analyst.

Claims20

Dependent claims

A process for binary code patch change vulnerability prioritization, the process comprising the steps of automatically:

obtaining a collection of patch differences representing changes to a precursor binary code;
identifying source functions of the precursor binary code, each source function specified in an export table, an import table, or a remote procedure call interface;
recognizing sink functions of the precursor binary code, each sink function specified in a blacklist, or capable of manipulating strings or memory;
constructing an architectural graph connecting sink functions and source functions;
and
assigning weights to respective patch differences, based on the architectural graph and on a set of rules which specify particular kinds of patch differences.

3 more elements

A computer-readable storage memory configured with data and with instructions that when executed by at least one processor causes the processor(s) to perform a process for binary code patch change vulnerability prioritization, the process comprising the steps of:

obtaining a collection of patch differences representing changes to a precursor binary code;
identifying at least one source function of the precursor binary code;
recognizing at least one sink function of the precursor binary code;
assigning weights to respective patch differences, each weighted patch difference being located between some identified source function and some recognized sink function, the source function specified in an export table, an import table, or a remote procedure call interface and the sink function specified in a blacklist, or capable of manipulating strings or memory;
and
outputting a list of patch differences ranked by weight.

3 more elements

Dependencies are inferred from the claim text.

Binary code change vulnerability prioritization

Life of this patent

Binary code change vulnerability prioritization

Life of this patent

Abstract

Claims20