Weighted security analysis
AssigneeInternational Business Machines Corporation
InventorOmer Tripp
Life of this patent
Estimating the term…
Abstract
A method, computer program product, and system for transforming unit tests is described. A unit test associated with one or more software units is identified. A graphical representation of a portion of a computer program is built, wherein the graphical representation includes a control flow edge. A potentially vulnerable data flow associated with the control flow edge is identified. A control flow weight is assigned to the control flow edge, based upon, at least in part, identifying the potentially vulnerable data flow. A security analysis is applied to the portion of the computer program based upon, at least in part, the control flow weight.
Claims14
A computer program product residing on a non-transitory computer-readable storage medium having a plurality of instructions stored thereon, which, when executed by a processor, cause the processor to perform operations comprising:
- building a graphical representation of a portion of a computer program, wherein the graphical representation includes a plurality of control flow edges;
- identifying a potentially vulnerable data flow associated with at least one of the plurality of control flow edges including:
- identifying one or more sink statements associated with the computer program;
- and
- determining one or more backward transitive closures of the one or more sink statements;
- assigning a control flow weight to each of the plurality of control flow edges, based upon, at least in part, identifying the potentially vulnerable data flow including determining a number of the one or more sink statements that are associated with a control flow edge based upon, at least in part, the backward transitive closure, wherein the control flow weight indicates how likely the potentially vulnerable data flow associated with the control flow edge implicates a security issue, wherein the control flow edge associated with a serious potential vulnerability is assigned a larger control flow weight than other control flow edges;
- and
- applying a security analysis to the portion of the computer program based upon, at least in part, the control flow weight.
A computer system comprising:
- one or more processors;
- and
- one or more memory architectures coupled with the one or more processors;
- wherein the one or more processors are configured to:
- build a graphical representation of a portion of a computer program, wherein the graphical representation includes a plurality of control flow edges;
- identify a potentially vulnerable data flow associated with at least one of the plurality of control flow edges including:
- identifying one or more sink statements associated with the computer program;
- and
- determining one or more backward transitive closures of the one or more sink statements;
- assign a control flow weight to each of the plurality of control flow edges, based upon, at least in part, identifying the potentially vulnerable data flow including determining a number of the one or more sink statements that are associated with a control flow edge based upon, at least in part, the backward transitive closure, wherein the control flow weight indicates how likely the potentially vulnerable data flow associated with the control flow edge implicates a security issue, wherein the control flow edge associated with a serious potential vulnerability is assigned a larger control flow weight than other control flow edges;
- and
- apply a security analysis to the portion of the computer program based upon, at least in part, the control flow weight.
Dependencies are inferred from the claim text.