# US 8,752,182 B2 · Pinpointing security vulnerabilities in computer software applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,752,182 B2 - Document ID: US8752182B2 - Status: Granted - Kind: B2 - Application number: 13/411,083 - Filed: 2012-03-02 - Published: 2012-10-18 - Granted: 2014-06-10 - Earliest claimed: 2011-04-13 - Assignees: International Business Machines Corporation - Applicants: Yair Amit; Roee Hay; Roi Saltzman; Adi Sharabani - Inventors: Yair Amit; Roee Hay; Roi Saltzman; Adi Sharabani - Web page: https://patentgrep.com/patent/US8752182B2 ## CPC - G06F 21/52: during program execution, e.g. stack integrity {; Preventing unwanted data erasure; Buffer overflow} - G06F 21/55: Detecting local intrusion or implementing counter-measures - G06F 2221/033: Test or assess software - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A build process management system can acquire data pertaining to a software build process that is currently being executed by an automated software build system. The software build process can include executable process steps, metadata, and/or environmental parameter values. An executable process step can utilize a build artifact, representing an electronic document that supports the software build process. The acquired data can then be synthesized into an immutable baseline build process and associated baseline artifact library. The baseline artifact library can store copies of the build artifacts. The immutable baseline build process can include baseline objects that represent data values and dependencies indicated in the software build process. In response to a user-specified command, an operation can be performed upon the baseline build process and associated baseline artifact library. ## Claims ### Claim 1 A method comprising: setting a debugging breakpoint within a computer software application proximate to an instruction that is correlated with an attack; performing the attack on the computer software application during execution of the computer software application in a debugging mode; halting the execution of the computer software application in the debugging mode when the attack triggers the debugging breakpoint; and displaying the instruction on a computer display within the context of an interactive debugging session. ### Claim 2 (depends on 1) The method according to claim 1 and further comprising correlating the instruction with the attack. ### Claim 3 (depends on 2) The method according to claim 2 and further comprising statically analyzing the computer software application, prior to correlating the instruction with the attack, to identify the instruction as potentially representing a security vulnerability. ### Claim 4 (depends on 2) The method according to claim 2 and further comprising performing the attack during execution of the computer software application prior to correlating the instruction with the attack. ### Claim 5 (depends on 4) The method according to claim 4 and further comprising performing the attack wherein the attack is designed to test for a security vulnerability. ### Claim 6 (depends on 4) The method according to claim 4 and further comprising: instrumenting the computer software application; monitoring the computer software application during its execution in the debugging mode; and detecting where the attack occurs within the computer software application, thereby identifying the instruction. ### Claim 7 (depends on 1) The method according to claim 1 wherein the step of displaying further comprises: displaying a description of the attack; displaying the instruction in the context of a listing of a plurality of instructions of the computer software application; and making at least one execution environment value of the computer software application available for inspection. ### Claim 8 (depends on 1) The method of claim 1, wherein the debugging breakpoint is set using a scan manager, wherein the attack performed on the software application uses a black-box tester, wherein the halting of the execution and the displaying of the instruction use a debugger, wherein the scan manager, the black-box tester, and the debugger each comprise computer program instructions stored in at least one storage medium, wherein the computer program instructions are executed by at least one processor. ### Claim 9 (depends on 1) The method of claim 1, wherein the attack is designed to test for a security vulnerability, said method further comprising: correlating the attack with an instruction from within the computer software application; making at least one execution environment value of the computer software application available for inspection. ### Claim 10 A method comprising: performing an attack on a computer software application during execution of the computer software application, wherein the attack is designed to test for a security vulnerability; correlating the attack with an instruction within the computer software application; setting a debugging breakpoint within the computer software application proximate to the instruction; performing the attack on the computer software application during execution of the computer software application in a debugging mode; halting the execution of the computer software application in the debugging mode when the attack triggers the debugging breakpoint; displaying the instruction and a description of the attack on a computer display within the context of an interactive debugging session; and making at least one execution environment value of the computer software application available for inspection. ### Claim 11 (depends on 10) The method according to claim 10 and further comprising statically analyzing the computer software application, prior to correlating the instruction with the attack, to identify the instruction as potentially representing a security vulnerability. ### Claim 12 (depends on 10) The method according to claim 10 and further comprising: instrumenting the computer software application; monitoring the computer software application during its execution in the debugging mode; and detecting where the attack occurs within the computer software application, thereby identifying the instruction. ### Claim 13 (depends on 10) The method of claim 10, wherein the attack is performed prior to correlating the instruction with the attack, said method further comprising: statistically analyzing the computer software application prior to correlating the instruction with the attack; responsive to the statistically analyzing and based upon results from the statistical analyzing, identifying the instruction as potentially representing a security vulnerability; instrumenting the computer software application; monitoring the computer software application during its execution in the debugging mode; and detecting where the attack occurs with the software application, thereby identifying the instruction.