Back to results
US 9,792,443 B1Granted
Position analysis of source code vulnerabilities
AssigneeWhiteHat Security, Inc.
InventorsEric Sheridan, Harry Papaxenopoulos, John Thomas Melton
Life of this patent
Estimating the term…
Abstract
Techniques for performing position analysis on a representation of an application source code are disclosed herein. An application source code is scanned to produce a representation of the application source code, start locations within the representation are determined, corresponding stop locations within the representation are determined, and a set of data impact locations within the representation are determined. The set of data impact locations are then used in a dataflow analysis to determine a position of high control of the data within the representation.
Claims20
A computer-implemented method:
- generating, at a sever, an abstract syntax tree representation of a representation of an application source code, the abstract syntax tree representation including a set of nodes and a set of edges, each node of the set of nodes corresponding to a respective instruction within the representation of the application source code, each edge of the set of edges connecting a pair of nodes, each edge of the set of edges representing a relationship between the pair of nodes;
- determining a set of start nodes within the abstract syntax tree representation, each start node of the set of start nodes corresponding to a respective start location within the representation of the application source code;
- determining, for each start node of the set of start nodes, a corresponding set of stop nodes within the abstract syntax tree representation, each stop node of the set of stop nodes corresponding to a respective stop location within the representation of the application source code;
- identifying a set of data impact nodes within the abstract syntax tree representation that impact a control metric of a set of data at one or more data positions within the representation of the application source code, the set of data impact nodes identified based at least in part on the respective instruction associated with each data impact node in the set of data impact nodes, wherein the control metric corresponds to an amount of control a malicious attacker has at the one or more data positions;
- performing a data flow analysis of the representation of the application source code, the data flow analysis starting from a selected start node of the set of start nodes, the data flow analysis stopping at a selected stop node of the set of stop nodes corresponding to the selected start node;
- determining, as part of the data flow analysis and based at least in part on the set of data impact nodes, a selected data position of the one or more data positions where the control metric of the set of data corresponding to the data position is at least equal to a data control threshold;
- and
- providing the selected data position.
5 more elements
A system, comprising:
- at least one computing device comprising at least one processor and at least one non-transitory memory storing instructions which when executed by the processor cause the at least one computing device to:
- generate a representation of an application source code;
- determine a set of start locations within the representation of the application source code, each start location of the set of start locations corresponding to respective start location within the representation of the application source code;
- determine, for each start location of the set of start locations, a corresponding set of stop locations within the representation of the application source code, each stop location of the set of stop locations corresponding to a respective start location within the representation of the application source code;
- identify a set of data impact locations within the representation of the application source code that impact a control of a set of data at one or more data positions within the representation of the application source code, the set of data impact locations identified based at least in part on a respective instruction associated with each data impact location in the set of data impact locations;
- and
- provide a set of selected data positions by performing a data flow analysis of the representation of the application source code, the data flow analysis starting from a selected start location of the set of start locations, the data flow analysis stopping at a selected stop location of the set of stop locations corresponding to the selected start location, the data flow analysis configured to select, based at least in part on the set of data impact locations, each selected data position of the set of selected data positions from the one or more data positions based at least in part on a location where a control metric of the set of data corresponding to the data position exceeds a data control threshold, wherein the control metric corresponds to an amount of control a malicious attacker has at the data position.
4 more elements
A tangible non-transitory computer-readable storage medium having code stored thereon that, when executed by a computer, causes the computer to perform operations including:
- determine a set of start locations within a representation of an application source code;
- determine, for each start location of the set of start locations, a corresponding set of stop locations within the representation of the application source code;
- identify a set of data impact locations within the representation of the application source code that impact a control of a set of data at one or more data positions within the representation of the application source code, the set of data impact locations identified based at least in part on a respective instruction associated with each data impact location in the set of data impact locations;
- perform a data flow analysis of the representation of the application source code, the data flow analysis starting from a selected start location of the set of start locations, the data flow analysis stopping at a selected stop location of the set of stop locations corresponding to the selected start location, the data flow analysis configured to determine, based at least in part on the set of data impact locations, a selected data position of the one or more data positions where a control metric of the set of data corresponding to the data position exceeds a data control threshold, wherein the control metric corresponds to an amount of control a malicious attacker has at the one or more data positions;
- and
- provide the selected data position.
3 more elements
Dependencies are inferred from the claim text.