Apparatus and method for analyzing and supplementing a program to provide security

• US 20070074169A1
• Filed: 08/25/2006
• Published: 03/29/2007
• Est. Priority Date: 08/25/2005
• Status: Active Grant

• Current Assignee: Micro Focus LLC (Open Text Corporation)
• Original Assignee: Fortify Software, Inc. (HP Inc.)
• Inventors: Chess, Brian, Thornton, Roger, Do, Arthur
• Granted Patent: US 8,347,392 B2
• Time in Patent Office: Days
• US Class Current: 717/126
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1483 service impersonation, e.g. phishing, pharming or web spoofing detection of rogue wireless access points H04W12/12
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]

Abstract

A computer readable storage medium has executable instructions to perform an automated analysis of program instructions. The automated analysis includes at least two analyses selected from an automated analysis of injection vulnerabilities, an automated analysis of potential repetitive attacks, an automated analysis of sensitive information, and an automated analysis of specific HTTP attributes. Protective instructions are inserted into the program instructions. The protective instructions are utilized to detect and respond to attacks during execution of the program instructions.

Claims

1. A computer readable storage medium, comprising executable instructions to:

perform an automated analysis of program instructions, wherein the automated analysis includes at least two analyses selected from an automated analysis of injection vulnerabilities, an automated analysis of potential repetitive attacks, an automated analysis of sensitive information, and an automated analysis of specific HTTP attributes;

insert protective instructions into the program instructions; and

utilize the protective instructions to detect and respond to attacks during execution of the program instructions.

2. The computer readable storage medium of claim 1 wherein injection vulnerabilities are selected from one or more of SQL injection, command injection, resource injection, log forging and cross site scripting.

3. The computer readable storage medium of claim 1 wherein repetitive attacks are selected from one or more of session ID guessing, credential guessing, click fraud and site probing.

4. The computer readable storage medium of claim 1 wherein sensitive information is selected from one or more of error mining, sensitive data extraction, and a privacy violation.

5. The computer readable storage medium of claim 1 wherein specific HTTP attributes are selected from one or more of session fixation, anonymous access, publicly available attack tools, and forceful browsing.

6. The compute readable storage medium of claim 1, wherein the executable instructions to respond to attacks include executable instructions to log information.

7. The compute readable storage medium of claim 1, wherein the executable instructions to respond to attacks include executable instructions to generate an alert.

8. The compute readable storage medium of claim 1, wherein the executable instructions to respond to attacks include executable instructions to halt the processing of a request.

9. The compute readable storage medium of claim 1, wherein the executable instructions to respond to attacks include executable instructions to defuse an attack.

10. The compute readable storage medium of claim 1, wherein the executable instructions to respond to attacks include executable instructions to issue a challenge.

11. The compute readable storage medium of claim 1, wherein the executable instructions to respond to attacks include executable instructions to slow down an application.

12. The compute readable storage medium of claim 1, wherein the executable instructions to respond to attacks include executable instructions to shut down an application.

13. The compute readable storage medium of claim 1, wherein the executable instructions to respond to attacks include executable instructions to invoke a user-defined response.