VALIDATING NORMALIZED CODE REPRESENTATIONS

• US 20140283096A1
• Filed: 03/15/2013
• Published: 09/18/2014
• Est. Priority Date: 03/15/2013
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Neerumalla, Bala, Fanning, Michael C., Ross, David A., Comeau, Alain, Rehberger, Johann, Calladine, Graham, Wan, Wing Kwong, Derryberry, George Raymond Jr., Cartwright, Mark
• Granted Patent: US 9,262,597 B2
• Time in Patent Office: Days
• US Class Current: 726/26
• CPC Class Codes: G06F 16/24564 Applying rules; Deductive queries
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/52 during program execution, e.g. stack integrity ; Preventing unwanted data erasure; Buffer overflow
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links

Abstract

A request that includes an indication of an execution context and data that represents executable code is obtained. An analysis of the data is initiated based on generating a first templatized representation of the executable code. A list of clearance indicators that indicate a blocking status associated with respective forms of templatized representations is accessed. A workflow policy is determined based on the accessing of the list of clearance indicators. The list of clearance indicators is updated, based on a result of the analysis of the data.

Claims

1. A system comprising:

a device that includes at least one processor, the device including a code validation engine comprising instructions tangibly embodied on a computer readable storage medium for execution by the at least one processor, the code validation engine including;

a request acquisition component configured to obtain a request that includes an indication of an execution context and data that represents executable code;

a data analysis component configured to initiate a first analysis of the data based on generating a first templatized representation of the executable code;

a list access component configured to access a list of one or more clearance indicators that indicate a blocking status associated with respective forms of templatized representations;

a workflow policy component configured to determine a first workflow policy based on the accessing of the list of clearance indicators; and

a list update component configured to initiate a first update to the list of one or more clearance indicators, based on a result of the first analysis of the data.

2. The system of claim 1, further comprising:

a template comparison component configured to initiate a comparison of the first templatized representation of the executable code with one or more entries in the list of clearance indicators.

3. The system of claim 2, wherein:

the data analysis component is configured to determine the first templatized representation of the executable code based on parsing a Structured Query Language (SQL) query included in the request, and determining a first templatized representation of the SQL query, based on the parsing of the SQL query, wherein

the system further includes a query comparison component configured to initiate a comparison of the first templatized representation of the SQL query with one or more entries in the list of one or more clearance indicators, wherein

the list of clearance indicators includes one or more of;

an allow list of clearance indicators that indicate a non-blocked status associated with at least a first portion of the respective forms of templatized representations, or

a deny list of clearance indicators that indicate a blocked status associated with at least a second portion of the respective forms of templatized representations, wherein

the query comparison component is configured to initiate the comparison of the first templatized representation of the SQL query with one or more entries in the list of clearance indicators based on one or more of;

initiating a structural comparison of the first templatized representation of the SQL query with one or more entries in the allow list of clearance indicators, or

initiating a structural comparison of the first templatized representation of the SQL query with one or more entries in the deny list of clearance indicators.

4. The system of claim 2, wherein:

the data analysis component is configured to determine the first templatized representation of the executable code based on parsing dynamic language code that is embedded in a web page, and determining a templatized form of the embedded dynamic language code, wherein

the system further includes a dynamic language comparison component configured to initiate a comparison of the templatized form of the embedded dynamic language code with one or more entries in the list of one or more clearance indicators.

5. The system of claim 4, wherein:

the dynamic language code includes one or more of;

script code, or

script code that is embedded within a web page that includes markup language.

6. A method comprising:

obtaining a request that includes an indication of an execution context and data that represents executable code;

initiating a first analysis of the data based on generating a first templatized representation of the executable code;

accessing a list of one or more clearance indicators that indicate a blocking status associated with respective forms of templatized representations;

determining a first workflow policy based on the accessing of the list of clearance indicators; and

initiating a first update to the list of one or more clearance indicators, based on a result of the first analysis of the data.

7. The method of claim 6, wherein:

the first analysis is performed on a client device, or

the first analysis is performed on a server.

8. The method of claim 6, further comprising:

determining a second workflow policy based on user input from a query requesting a blocking decision; and

initiating a second update to the list of one or more clearance indicators, based on the user input.

9. The method of claim 6, further comprising:

initiating a second analysis that includes;

initiating configuration of a runtime environment for dynamic analysis,

initiating a conversion of the data to an executable code format, and

initiating execution of the executable code format corresponding to the converted data; and

initiating a second update to the list of one or more clearance indicators, based on a result of the second analysis.

10. The method of claim 9, wherein:

initiating the second update to the list of one or more clearance indicators is based on detecting one or more exceptions that occur during execution of the executable code format corresponding to the converted data.

11. The method of claim 9, wherein:

a decision to initiate execution of the executable code format corresponding to the converted data is based on;

determining a permission status associated with avoidance of configuration of the runtime environment and conversion of the data to an executable code format, based on the obtained workflow policy, or

determining a permission status associated with granting permission to initiate configuration of the runtime environment and conversion of the data to an executable code format, based on the obtained workflow policy.

12. The method of claim 6, further comprising:

determining a matching status of the first templatized representation of the executable code with an entry in the list of one or more clearance indicators, based on a matching algorithm, wherein

determining the first workflow policy includes obtaining the first workflow policy based on the determined matching status.

13. The method of claim 6, wherein:

the list of clearance indicators includes one or more of;

an allow list of clearance indicators that indicate a non-blocked status associated with at least a first portion of the respective forms of templatized representations, or

a deny list of clearance indicators that indicate a blocked status associated with at least a second portion of the respective forms of templatized representations.

14. The method of claim 6, further comprising:

initiating a comparison of the first templatized representation of the executable code with one or more entries in the list of clearance indicators.

15. The method of claim 14, wherein:

determining the first templatized representation of the executable code includes parsing a Structured Query Language (SQL) query included in the request, and determining a first templatized representation of the SQL query, based on the parsing of the SQL query, wherein

the method further includes initiating a comparison of the first templatized representation of the SQL query with one or more entries in the list of one or more clearance indicators.

16. The method of claim 15, wherein:

the list of clearance indicators includes one or more of;

an allow list of clearance indicators that indicate a non-blocked status associated with at least a first portion of the respective forms of templatized representations, or

a deny list of clearance indicators that indicate a blocked status associated with at least a second portion of the respective forms of templatized representations, wherein

initiating the comparison of the first templatized representation of the SQL query with one or more entries in the list of clearance indicators includes one or more of;

initiating a structural comparison of the first templatized representation of the SQL query with one or more entries in the allow list of clearance indicators, or

initiating a structural comparison of the first templatized representation of the SQL query with one or more entries in the deny list of clearance indicators.

17. The method of claim 14, wherein:

determining the first templatized representation of the executable code includes parsing dynamic language code that is embedded in a web page, and determining a templatized form of the embedded dynamic language code, wherein

the method further includes initiating a comparison of the templatized form of the embedded dynamic language code with one or more entries in the list of one or more clearance indicators.

18. The method of claim 6, wherein:

initiating the first analysis of the data includes a first static analysis of the data that represents executable code, wherein

initiating the first update to the list of one or more clearance indicators is based on results of the first static analysis of the data that represents executable code.

19. The method of claim 18, wherein:

initiating the first analysis of the data includes determining a canonical format representation associated with the request, wherein

initiating the first update to the list of one or more clearance indicators includes initiating the first update based on a self learning algorithm that includes;

updating an allow list portion of the list of clearance indicators with the canonical format representation associated with the request, based on the results of the first static analysis of the data that represents executable code, the clearance indicators in the allow list portion indicating a non-blocked status associated with at least a first portion of the respective forms of templatized representations, and

updating a deny list portion of the list of clearance indicators with the canonical format representation associated with the request, based on the results of the first static analysis of the data that represents executable code, the clearance indicators in the deny list portion indicating a blocked status associated with at least a second portion of the respective forms of templatized representations.

20. A computer program product tangibly embodied on a computer-readable storage medium and comprising executable code that causes at least one data processing apparatus to:

obtain a request that includes an indication of an execution context and data that represents executable code;

initiate a first analysis of the data based on generating a first templatized representation of the executable code;

access a list of one or more clearance indicators that indicate a blocking status associated with respective forms of templatized representations;

determine a first workflow policy based on the accessing of the list of clearance indicators; and

initiate a first update to the list of one or more clearance indicators, based on a result of the first analysis of the data.