System, method and apparatus to visually configure an analysis of a program

Patent metadata

Field	Value
Publication number	US-9892263-B2
Application number	US-201715492495-A
Country	US
Kind code	B2
Filing date	Apr 20, 2017
Priority date	Apr 4, 2014
Publication date	Feb 13, 2018
Grant date	Feb 13, 2018

Abstract

A method extracts views from an application program, where at least some extracted views include at least one view component, and presenting the extracted views to a user. In response to the user selecting a view component in a presented extracted view, the method presents a form to the user having a plurality of vulnerability types indicated for the selected view component and, for each vulnerability type, provides an ability for the user to set an indicator in the form as to indicate whether the view component is at least one of a source or a sink. The method further includes saving the form containing the user's input in conjunction with a user-provided label for the selected view component and a unique identification of the selected view component, and deriving an analysis policy configuration from the saved form that is formatted for use by a program security analyzer.

First claim

What is claimed is:

1. A method, comprising:
extracting views from an application program, where at least some extracted views comprise at least one view component, the at least one view component comprising an application-specific screenshot of a user-interface content and layout;
presenting the extracted views to a user;
in response to the user selecting a view component in a presented extracted view, presenting a form to the user having a plurality of vulnerability types indicated for the selected view component and, for each vulnerability type, providing an ability for the user to set an indicator in the form to indicate whether the view component is at least one of a source or a sink;
saving the form containing the user's input in conjunction with a user-provided label for the selected view component and a unique identification of the selected view component; and
deriving an analysis policy configuration from the saved form that is formatted for use by a program security analyzer.

2. The method of claim 1 , where the unique identification comprises at least geometric coordinates of the selected view component in the view containing the selected view component.

3. The method of claim 1 , where extracting views is performed statically by an analysis of the application program source code.

4. The method of claim 1 , where extracting views is performed dynamically by emulating the execution of the application program and recording in chronological order the views as they are generated by the application program.

5. The method of claim 1 , where the vulnerability types comprise at least Cross-site scripting (XSS), Structured Query Language (SQL) injection, Command injection, and confidentiality.

6. The method as in claim 1 , where saving the form containing the user's input further comprises saving at least one of non-visual activities and resources associated with the selected view component.

7. The method of claim 1 , where providing the ability for the user to set an indicator in the form further enables the user to designate whether the selected view component is associated with an entry point or with a downgrader.

8. A system, comprised of at least one data processor connected with at least one memory that stores software instructions, where execution of the software instructions by the at least one data processor causes the system to:
extract views from an application program, where at least some extracted views comprise at least one view component, the at least one view component comprising an application-specific screenshot of a user-interface content and layout;
present the extracted views to a user;
in response to the user selecting a view component in a presented extracted view, present a form to the user having a plurality of vulnerability types indicated for the selected view component and, for each vulnerability type, provide an ability for the user to set an indicator in the form as to whether the view component is at least one of a source or a sink;
save the form containing the user's input in conjunction with a user-provided label for the selected view component and a unique identification of the selected view component; and
derive an analysis policy configuration from the saved form that is formatted for use by a program security analyzer.

9. The system of claim 8 , where the unique identification comprises at least geometric coordinates of the selected view component in the view containing the selected view component.

10. The system of claim 8 , where the system extracts the views statically by an analysis of the application program source code, or where the system extracts the views dynamically by emulating the execution of the application program and recording in chronological order the views as they are generated by the application program.

11. The system of claim 8 , where the vulnerability types comprise at least Cross-site scripting (XSS), Structured Query Language (SQL) injection, Command injection, and confidentiality, and where the saved form containing the user's input further comprises an indication of at least one of non-visual activities and resources associated with the selected view component.

12. The system of claim 8 , where the provided ability for the user to set an indicator in the form further enables the user to designate whether the selected view component is associated with an entry point or with a downgrader.

13. A computer program product comprised of software instructions on a computer-readable medium, where execution of the software instructions using a computer results in performing operations comprising:
extracting views from an application program, where at least some extracted views comprise at least one view component, the at least one view component comprising an application-specific screenshot of a user-interface content and layout;
presenting the extracted views to a user;
in response to the user selecting a view component in a presented extracted view, presenting a form to the user having a plurality of vulnerability types indicated for the selected view component and, for each vulnerability type, providing an ability for the user to set an indicator in the form to indicate whether the view component is at least one of a source or a sink;
saving the form containing the user's input in conjunction with a user-provided label for the selected view component and a unique identification of the selected view component; and
deriving an analysis policy configuration from the saved form that is formatted for use by a program security analyzer.

14. The computer program product of claim 13 , where the unique identification comprises at least geometric coordinates of the selected view component in the view containing the selected view component.

15. The computer program product of claim 13 , where extracting views is performed statically by an analysis of the application program source code.

16. The computer program product of claim 13 , where extracting views is performed dynamically by emulating the execution of the application program and recording in chronological order the views as they are generated by the application program.

17. The computer program product of claim 13 , where the vulnerability types comprise at least Cross-site scripting (XSS), Structured Query Language (SQL) injection, Command injection, and confidentiality.

18. The computer program product of claim 13 , where saving the form containing the user's input further comprises saving at least one of non-visual activities and resources associated with the selected view component.

19. The computer program product of claim 13 , where providing the ability for the user to set an indicator in the form further enables the user to designate whether the selected view component is associated with an entry point or with a downgrader.

20. The computer program product of claim 13 , where the computer program product and the program security analyzer are embodied on the same platform, or where the computer program product and the program security analyzer are embodied on different platforms, and where the platform or platforms comprise a hardware instantiation or a virtual, cloud-based instantiation.

Assignees

• IBM

Inventors

• Ligman Joseph W
• Pistoia Marco
• Tripp Omer

Classifications

• G06F2221/033

  Test or assess software · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title