Dynamic analysis interpreter modification for application dataflow

• US 9,152,796 B2
• Filed: 05/28/2014
• Issued: 10/06/2015
• Est. Priority Date: 10/30/2013
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Gluck, Yoel, Wang, Xiaoran
• Primary Examiner(s): CHAVIS, JOHN Q
• Application Number:
  US14/288,563
• Publication Number:
  US 20150121533A1
• Time in Patent Office: 496 Days
• Field of Search: 717/130, 726/25
• US Class Current: 1/1
• CPC Class Codes: G06F 11/3003 Monitoring arrangements specially adapted to the computing system or computing system component being monitored
• CPC Class Codes: G06F 11/3072 where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
• CPC Class Codes: G06F 11/3093 Configuration details thereof, e.g. installation, enabling, spatial arrangement of the probes
• CPC Class Codes: G06F 11/3466 Performance evaluation by tracing or monitoring
• CPC Class Codes: G06F 11/3476 Data logging G06F11/14, G06F11/2205 take precedence
• CPC Class Codes: G06F 11/3604 Software analysis for verifying properties of programs byte-code verification G06F9/44589
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security
• CPC Class Codes: G06F 2201/86 Event-based monitoring
• CPC Class Codes: G06F 2201/865 Monitoring of software

Abstract

An interpreter is modified to create a source tracking object for a data object received from a data source and to record information associated with the data source into the source tracking object. The interpreter is modified to create a copy of the data object for a tracking event in an application program, to create a flow tracking object for the tracking event, and to record information associated with the tracking event into the flow tracking object as the tracking event processes the copy of the data object. The interpreter is modified to create a sink tracking object for outputting the copy of the data object to a data sink and to record information associated with the data sink into the sink tracking object. The source tracking object, the flow tracking object, and the sink tracking object are output as dynamic analysis of dataflow in the application program.

Claims

1. An apparatus for dynamic analysis interpreter modification for application dataflow, the apparatus comprising:

a processor; and

a non-transitory computer readable medium storing a plurality of instructions, which when executed, cause the one or more processors to;

modify an interpreter to create a source tracking object for a data object received from a data source;

modify the interpreter to record information associated with the data source into the source tracking object;

modify the interpreter to create a copy of the data object for a tracking event in an application program;

modify the interpreter to create a flow tracking object for the tracking event;

modify the interpreter to record information associated with the tracking event into the flow tracking object as the tracking event processes the copy of the data object;

modify the interpreter to create a sink tracking object for outputting the copy of the data object to a data sink;

modify the interpreter to record information associated with the data sink into the sink tracking object; and

output the source tracking object, the flow tracking object, and the sink tracking object as dynamic analysis of dataflow in the application program.

2. The apparatus of claim 1, wherein the tracking event comprises one of a method invocation, an assignment, and a field assignment of the copy of the wrapper object to a field of another wrapper object.

3. The apparatus of claim 1, wherein the plurality instructions, which when executed further cause the one or more processors to:

modify the interpreter to replace the data object with a wrapper object that points to the data object;

modify the interpreter to create a second wrapper object for a second tracking event in the application program;

modify the interpreter to create a second flow tracking object for the second tracking event;

modify the interpreter to record information associated with the second tracking event into the second flow tracking object as the second tracking event processes the second wrapper object;

modify the interpreter to associate the flow tracking object with the second flow tracking object in response to a field retrieval of the copy of the wrapper object from the second wrapper object; and

output the associated second flow tracking object as dynamic analysis of dataflow in the application program.

4. The apparatus of claim 3, wherein the plurality instructions, which when executed further cause the one or more processors to:

modify the interpreter to connect the source tracking object with the wrapper object;

modify the interpreter to connect the flow tracking object with the copy of the wrapper object;

modify the interpreter to connect the second flow tracking object with the second wrapper object; and

modify the interpreter to connect the sink tracking object with the copy of the wrapper object.

5. The apparatus of claim 4, wherein outputting the source tracking object, the flow tracking object, and the sink tracking object comprises outputting the source tracking object as a first node in a graph, the flow tracking object as a second node in the graph, the associated second flow tracking object as a third node in the graph, and the sink tracking object as a fourth node in the graph, wherein the second node is linked to the first node, the third node is linked to the second node, and the fourth node is linked to the third node to depict the dataflow sequence of the graph.

6. A non-transitory machine-readable medium carrying one or more sequences of instructions dynamic analysis interpreter modification for application dataflow, which instructions, when executed by one or more processors, cause the one or more processors to:

modify an interpreter to create a source tracking object for a data object received from a data source;

modify the interpreter to record information associated with the data source into the source tracking object;

modify the interpreter to create a copy of the data object for a tracking event in an application program;

modify the interpreter to create a flow tracking object for the tracking event;

modify the interpreter to record information associated with the tracking event into the flow tracking object as the tracking event processes the copy of the data object;

modify the interpreter to create a sink tracking object for outputting the copy of the data object to a data sink;

modify the interpreter to record information associated with the data sink into the sink tracking object; and

output the source tracking object, the flow tracking object, and the sink tracking object as dynamic analysis of dataflow in the application program.

7. The machine-readable medium of claim 6, wherein the tracking event comprises one of a method invocation, an assignment, and a field assignment of the copy of the wrapper object to a field of another wrapper object.

8. The machine-readable medium of claim 6, wherein the instructions, when executed by one or more processors, further cause the one or more processors to:

modify the interpreter to replace the data object with a wrapper object that points to the data object;

modify the interpreter to create a second wrapper object for a second tracking event in the application program;

modify the interpreter to create a second flow tracking object for the second tracking event;

modify the interpreter to record information associated with the second tracking event into the second flow tracking object as the second tracking event processes the second wrapper object;

modify the interpreter to associate the flow tracking object with the second flow tracking object in response to a field retrieval of the copy of the wrapper object from the second wrapper object; and

output the associated second flow tracking object as dynamic analysis of dataflow in the application program.

9. The machine-readable medium of claim 8, wherein the instructions, when executed by one or more processors, further cause the one or more processors to:

modify the interpreter to connect the source tracking object with the wrapper object;

modify the interpreter to connect the flow tracking object with the copy of the first wrapper object;

modify the interpreter to connect the second flow tracking object with the second wrapper object; and

modify the interpreter to connect the sink tracking object with the copy of the wrapper object.

10. The machine-readable medium of claim 9, wherein outputting the source tracking object, the flow tracking object, and the sink tracking object comprises outputting the sink tracking object as a first node in a graph, the flow tracking object as a second node in the graph, the associated second flow tracking object as a third node in the graph, and the sink tracking object as a fourth node in the graph, wherein the second node is linked to the first node, the third node is linked to the second node, and the fourth node is linked to the third node to depict the dataflow sequence of the graph.

11. A method for dynamic analysis interpreter modification for application dataflow, the method comprising:

modifying an interpreter to create a source tracking object for a data object received from a data source;

modifying the interpreter to record information associated with the data source into the source tracking object;

modifying the interpreter to create a copy of the data object for a tracking event in an application program;

modifying the interpreter to create a flow tracking object for the tracking event;

modifying the interpreter to record information associated with the tracking event into the flow tracking object as the tracking event processes the copy of the data object;

modifying the interpreter to create a sink tracking object for outputting the copy of the data object to a data sink;

modifying the interpreter to record information associated with the data sink into the sink tracking object; and

outputting the source tracking object, the flow tracking object, and the sink tracking object as dynamic analysis of dataflow in the application program.

12. The method of claim 11, wherein the tracking event comprises one of a method invocation, an assignment, and a field assignment of the copy of the wrapper object to a field of another wrapper object.

13. The method of claim 11, wherein the method further comprises:

modifying the interpreter to replace the data object with a wrapper object that points to the data object;

modifying the interpreter to create a second wrapper object for a second tracking event in the application program;

modifying the interpreter to create a second flow tracking object for the second tracking event;

modifying the interpreter to record information associated with the second tracking event into the second flow tracking object as the second tracking event processes the second wrapper object;

modifying the interpreter to associate the flow tracking object with the second flow tracking object in response to a field retrieval of the copy of the wrapper object from the second wrapper object; and

outputting the associated second flow tracking object as dynamic analysis of dataflow in the application program.

14. The method of claim 13, wherein the method further comprises:

modifying the interpreter to connect the source tracking object with the wrapper object;

modifying the interpreter to connect the flow tracking object with the copy of the first wrapper object;

modifying the interpreter to connect the second flow tracking object with the second wrapper object; and

modifying the interpreter to connect the sink tracking object with the copy of the wrapper object.

15. The method of claim 14, wherein outputting the source tracking object, the flow tracking object, and the sink tracking object comprises outputting the source tracking object as a first node in a graph, the flow tracking object as a second node in the graph, the associated second flow tracking object as a third node in the graph, and the sink tracking object as a fourth node in the graph, wherein the second node is linked to the first node, the third node is linked to the second node, and the fourth node is linked to the third node to depict the dataflow sequence of the graph.

16. A system comprising:

a computer having one or more processors;

a processor-based application, which when executed by the computer, will cause the one or more processors to;

modify an interpreter to create a source tracking object for a data object received from a data source;

modify the interpreter to record information associated with the data source into the source tracking object;

modify the interpreter to create a copy of the data object for a tracking event in an application program;

modify the interpreter to create a flow tracking object for the tracking event;

modify the interpreter to record information associated with the tracking event into the flow tracking object as the tracking event processes the copy of the data object;

modify the interpreter to create a sink tracking object for outputting the copy of the data object to a data sink;

modify the interpreter to record information associated with the data sink into the sink tracking object; and

output the source tracking object, the flow tracking object, and the sink tracking object as dynamic analysis of dataflow in the application program.

17. The system of claim 16, wherein the tracking event comprises one of a method invocation, an assignment, and a field assignment of the copy of the wrapper object to a field of another wrapper object.

18. The system of claim 16, wherein the processor-based application, when executed, will further cause the one or more processors to:

modify the interpreter to replace the data object with a wrapper object that points to the data object;

modify the interpreter to create a second wrapper object for a second tracking event in the application program;

modify the interpreter to create a second flow tracking object for the second tracking event;

modify the interpreter to record information associated with the second tracking event into the second flow tracking object as the second tracking event processes the second wrapper object;

modify the interpreter to associate the flow tracking object with the second flow tracking object in response to a field retrieval of the copy of the wrapper object from the second wrapper object; and

output the associated second flow tracking object as dynamic analysis of dataflow in the application program.

19. The system of claim 18, wherein the processor-based application, when executed, will further cause the one or more processors to:

modify the interpreter to connect the source tracking object with the wrapper object;

modify the interpreter to connect the flow tracking object with the copy of the wrapper object;

modify the interpreter to connect the second flow tracking object with the second wrapper object; and

modify the interpreter to connect the sink tracking object with the copy of the wrapper object.

20. The system of claim 16, wherein outputting the source tracking object, the flow tracking object, and the sink tracking object comprises outputting the sink tracking object as a first node in a graph, the flow tracking object as a second node in the graph, the associated second flow tracking object as a third node in the graph, and the sink tracking object as a fourth node in the graph, wherein the second node is linked to the first node, the third node is linked to the second node, and the fourth node is linked to the third node to depict the dataflow sequence of the graph.