Static security analysis using a hybrid representation of string values

Patent metadata

Field	Value
Publication number	US-2016378995-A1
Application number	US-201615262631-A
Country	US
Kind code	A1
Filing date	Sep 12, 2016
Priority date	Sep 12, 2012
Publication date	Dec 29, 2016
Grant date	—

Abstract

A hybrid string constructor includes a database configured to store a set of known concretizations. A processor is configured to compare the one or more string components to the set of known concretizations to determine string components from input string information that may be represented concretely, to abstract all string components that could not be represented concretely, and to create a hybrid string representation that includes at least one concrete string component and at least one abstracted string component. The set of known concretizations includes string configurations that cannot be interfered with by an attacker.

First claim

What is claimed is:

1 . A hybrid string constructor, comprising:
a database configured to store a set of known concretizations; and a processor configured to compare the one or more string components to the set of known concretizations to determine string components from input string information that may be represented concretely, to abstract all string components that could not be represented concretely, and to create a hybrid string representation that includes at least one concrete string component and at least one abstracted string component, wherein the set of known concretizations includes string configurations that cannot be interfered with by an attacker.

2 . The hybrid string constructor of claim 1 , wherein the set of known concretizations includes strings that refer to a page's uniform resource location.

3 . The hybrid string constructor of claim 2 , wherein the set of known concretizations includes strings that include the JavaScript® object “document.location.”

4 . The hybrid string constructor of claim 1 , wherein the processor is further configured to bind between an external configuration file and string variables to automatically concretize a string component.

5 . The hybrid string constructor of claim 4 , wherein the processor is further configured to monitor framework interfaces used to retrieve string values from the configuration files.

6 . The hybrid string constructor of claim 1 , wherein the processor is further configured to replace a string component with one or more regular expressions to abstract the string component.

7 . The hybrid string constructor of claim 1 , wherein the processor is further configured to concatenate said at least one concrete string component and said at least one abstracted string component to form a hybrid string representation.

8 . The hybrid string constructor of claim 1 , wherein the string information comprises a combination of program code and markup code.

9 . The hybrid string constructor of claim 1 , wherein the processor is further configured to perform a taint analysis on the hybrid string representation to locate potential vulnerabilities.

Assignees

• IBM

Inventors

• Guarnieri Salvatore A
• Pistoia Marco
• Tripp Omer

Classifications

• G06F40/221

  Parsing markup language streams (streaming G06F40/149) · CPC title

• H04L63/1408

  by monitoring network traffic (monitoring network traffic per se H04L43/00) · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• G06F40/103

  Formatting, i.e. changing of presentation of documents (automatic justification G06F40/189; automatic line break hyphenation G06F40/191) · CPC title