System and method for dynamic analysis tracking objects for application dataflow

• US 9,171,150 B2
• Filed: 10/30/2013
• Issued: 10/27/2015
• Est. Priority Date: 12/14/2012
• Status: Active Grant

• Current Assignee: Salesforce.com, Inc.
• Original Assignee: Salesforce.com, Inc.
• Inventors: Gluck, Yoel, Wang, Xiaoran
• Primary Examiner(s): Truong, Thanhnga B
• Application Number:
  US14/067,131
• Publication Number:
  US 20140173741A1
• Time in Patent Office: 727 Days
• Field of Search: 726 22- 25, 717/130, 707/736, 707/800
• US Class Current: 1/1
• CPC Class Codes: G06F 21/54 by adding security routines or objects to programs
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/1433 Vulnerability analysis

Abstract

Systems and methods are provided for dynamic analysis tracking objects for application dataflow. A system receives a data object from a data source, creates a source tracking object for the data object, and records information associated with the data source into the source tracking object. The system creates a copy of the data object for a tracking event in the application program, creates a flow tracking object for the tracking event, and records information associated with the tracking event into the flow tracking object as the tracking event processes the copy of the data object. The system outputs the copy of the data object to a data sink, creates a sink tracking object for the data sink, and records information associated with the data sink into the sink tracking object. The system outputs the source tracking object, the flow tracking object, and the sink tracking object as dynamic analysis of dataflow in the application program.

Claims

1. An apparatus for dynamic analysis tracking objects for application dataflow, the apparatus comprising:

a processor; and

one or more stored sequences of instructions which, when executed by the processor, cause the processor to;

receive a data object from a data source;

create a source tracking object for the data object;

record information associated with the data source into the source tracking object;

create a copy of the data object for a tracking event in the application program;

create a flow tracking object for the tracking event;

record information associated with the tracking event into the flow tracking object as the tracking event processes the copy of the data object;

output the copy of the data object to a data sink;

create a sink tracking object for the data sink;

record information associated with the data sink into the sink tracking object; and

output the source tracking object, the flow tracking object, and the sink tracking object as dynamic analysis of dataflow in the application program.

2. The apparatus of claim 1, wherein the instructions, when executed by the processor, cause the processor to:

connect the source tracking object with the data object;

connect the flow tracking object with the copy of the data object; and

connect the sink tracking object with the copy of the data object.

3. The apparatus of claim 1, wherein the tracking event comprises one of a method invocation, an assignment, field access, store, and array access.

4. The apparatus of claim 1, wherein outputting the source tracking object, the flow tracking object, and the sink tracking object comprises outputting the sink tracking object as a first node in a graph, the flow tracking object as a second node in the graph, and the sink tracking object as a third node in the graph, wherein the second node is linked to the first node and the third node is linked to the second node to depict the dataflow sequence of the graph.

5. The apparatus of claim 1, wherein the steps further comprise:

create a second copy of the data object for a second tracking event in the application program;

create a second flow tracking object for the second tracking event;

connect the second flow tracking object with the second copy of the data object;

record information associated with the second tracking event into the second flow tracking object as the second tracking event processes the second copy of the data object; and

delete the second flow tracking object when the application program lacks a subsequent reference to the second copy of the data object.

6. A non-transitory machine-readable medium carrying one or more sequences of instructions for dynamic analysis tracking objects for application dataflow, which instructions, when executed by one or more processors, cause the one or more processors to carry out the steps of:

receiving a data object from a data source;

creating a source tracking object for the data object;

recording information associated with the data source into the source tracking object;

creating a copy of the data object for a tracking event in the application program;

creating a flow tracking object for the tracking event;

recording information associated with the tracking event into the flow tracking object as the tracking event processes the copy of the data object;

outputting the copy of the data object to a data sink;

creating a sink tracking object for the data sink;

recording information associated with the data sink into the sink tracking object; and

outputting the source tracking object, the flow tracking object, and the sink tracking object as dynamic analysis of dataflow in the application program.

7. The non-transitory machine-readable medium of claim 6, wherein the steps further comprise:

connecting the source tracking object with the data object;

connecting the flow tracking object with the copy of the data object; and

connecting the sink tracking object with the copy of the data object.

8. The non-transitory machine-readable medium of claim 6, wherein the tracking event comprises one of a method invocation, an assignment, field access, store, and array access.

9. The non-transitory machine-readable medium of claim 6, wherein outputting the source tracking object, the flow tracking object, and the sink tracking object comprises outputting the sink tracking object as a first node in a graph, the flow tracking object as a second node in the graph, and the sink tracking object as a third node in the graph, wherein the second node is linked to the first node and the third node is linked to the second node to depict the dataflow sequence of the graph.

10. The non-transitory machine-readable medium of claim 6, wherein the steps further comprise:

creating a second copy of the data object for a second tracking event in the application program;

creating a second flow tracking object for the second tracking event;

connecting the second flow tracking object with the second copy of the data object;

recording information associated with the second tracking event into the second flow tracking object as the second tracking event processes the second copy of the data object; and

deleting the second flow tracking object when the application program lacks a subsequent reference to the second copy of the data object.

11. A method for dynamic analysis tracking objects for application dataflow, the method comprising:

receiving, by a computing system having at least one processor, a data object from a data source;

creating, by the computing system, a source tracking object for the data object;

recording, by the computing system, information associated with the data source into the source tracking object;

creating, by the computing system, a copy of the data object for a tracking event in the application program;

creating, by the computing system, a flow tracking object for the tracking event;

recording, by the computing system, information associated with the tracking event into the flow tracking object as the tracking event processes the copy of the data object;

outputting, by the computing system, the copy of the data object to a data sink;

creating, by the computing system, a sink tracking object for the data sink;

recording, by the computing system, information associated with the data sink into the sink tracking object; and

outputting, by the computing system, the source tracking object, the flow tracking object, and the sink tracking object as dynamic analysis of dataflow in the application program.

12. The method of claim 11, wherein the method further comprises:

connecting, by the computing system, the source tracking object with the data object;

connecting, by the computing system, the flow tracking object with the copy of the data object; and

connecting, by the computing system, the sink tracking object with the copy of the data object.

13. The method of claim 11, wherein the tracking event comprises one of a method invocation, an assignment, field access, store, and array access.

14. The method of claim 11, wherein outputting the source tracking object, the flow tracking object, and the sink tracking object comprises outputting, by the computing system, the sink tracking object as a first node in a graph, the flow tracking object as a second node in the graph, and the sink tracking object as a third node in the graph, wherein the second node is linked to the first node and the third node is linked to the second node to depict the dataflow sequence of the graph.

15. The method of claim 11, wherein the method further comprises:

creating, by the computing system, a second copy of the data object for a second tracking event in the application program;

creating, by the computing system, a second flow tracking object for the second tracking event;

connecting, by the computing system, the second flow tracking object with the second copy of the data object;

recording, by the computing system, information associated with the second tracking event into the second flow tracking object as the second tracking event processes the second copy of the data object; and

deleting, by the computing system, the second flow tracking object when the application program lacks a subsequent reference to the second copy of the data object.

16. A method for transmitting code for dynamic analysis tracking objects for application dataflow, the method comprising:

transmitting code, by at least one computer processor, to receive a data object from a data source;

transmitting code, by the at least one computer processor, to create a source tracking object for the data object;

transmitting code, by the at least one computer processor, to record information associated with the data source into the source tracking object;

transmitting code, by the at least one computer processor, to create a copy of the data object for a tracking event in the application program;

transmitting code, by the at least one computer processor, to create a flow tracking object for the tracking event;

transmitting code, by the at least one computer processor, to record information associated with the tracking event into the flow tracking object as the tracking event processes the copy of the data object;

transmitting code, by the at least one computer processor., to output the copy of the data object to a data sink;

transmitting code, by the at least one computer processor, to create a sink tracking object for the data sink;

transmitting code, by the at least one computer processor, to record information associated with the data sink into the sink tracking object; and

transmitting code, by the at least one computer processor, to output the source tracking object, the flow tracking object, and the sink tracking object as dynamic analysis of dataflow in the application program.

17. The method for transmitting code of claim 16, wherein the method further comprises:

transmitting code, by the at least one computer processor, to connect the source tracking object with the data object;

transmitting code, by the at least one computer processor, to connect the flow tracking object with the copy of the data object; and

transmitting code, by the at least one computer processor, to connect the sink tracking object with the copy of the data object.

18. The method for transmitting code of claim 16, wherein the tracking event comprises one of a method invocation, an assignment, field access, store, and array access.

19. The method for transmitting code of claim 16, wherein outputting the source tracking object, the flow tracking object, and the sink tracking object comprises outputting, by the at least one computer processor, the sink tracking object as a first node in a graph, the flow tracking object as a second node in the graph, and the sink tracking object as a third node in the graph, wherein the second node is linked to the first node and the third node is linked to the second node to depict the dataflow sequence of the graph.

20. The method for transmitting code of claim 16, wherein the method further comprises:

transmitting code, by the at least one computer processor, to create a second copy of the data object for a second tracking event in the application program;

transmitting code, by the at least one computer processor, to create a second flow tracking object for the second tracking event;

transmitting code, by the at least one computer processor, to connect the second flow tracking object with the second copy of the data object;

transmitting code, by the at least one computer processor, to record information associated with the second tracking event into the second flow tracking object as the second tracking event processes the second copy of the data object; and

transmitting code, by the at least one computer processor, to delete the second flow

tracking object when the application program lacks a subsequent reference to the second copy of the data object.