Hybrid analysis of vulnerable information flows
First Claim
1. A method of analyzing vulnerable information flows in an application, the method comprising:
- performing, using a hardware processor, a black-box scan of the application;
based on the black-box scan, recording a call-tree representation of a plurality of call stacks arising in the application due to test inputs provided during the black-box scan, the call tree representation indicating paths between the plurality of call stacks;
performing, for each of the paths in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, a static analysis, and by the static analysis determining at least one parameter value that, when abstracted, drives execution of the application, via the path in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, to flow to the at least one security sink; and
generating a security report identifying at least one of the paths in the call-tree representation that does not constitute the vulnerable information flow during the black-box scan, but flows to the at least one security sink when the at least one parameter value is abstracted.
1 Assignment
0 Petitions
Accused Products
Abstract
Arrangements described herein relate to analyzing vulnerable information flows in an application. A black-box scan of the application can be performed to record a call-tree representation of call stacks arising in the application due to test inputs provided during the black-box scan. For each path in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, a static analysis can be performed to determine at least one parameter value that, when abstracted, drives execution of the application, via the path, to flow to the at least one security sink. A security report can be generated identifying at least one of the paths in the call-tree representation that does not constitute the vulnerable information flow during the black-box scan, but flows to the at least one security sink when the at least one parameter value is abstracted.
15 Citations
9 Claims
-
1. A method of analyzing vulnerable information flows in an application, the method comprising:
-
performing, using a hardware processor, a black-box scan of the application; based on the black-box scan, recording a call-tree representation of a plurality of call stacks arising in the application due to test inputs provided during the black-box scan, the call tree representation indicating paths between the plurality of call stacks; performing, for each of the paths in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, a static analysis, and by the static analysis determining at least one parameter value that, when abstracted, drives execution of the application, via the path in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, to flow to the at least one security sink; and generating a security report identifying at least one of the paths in the call-tree representation that does not constitute the vulnerable information flow during the black-box scan, but flows to the at least one security sink when the at least one parameter value is abstracted. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8)
-
-
9. A method of analyzing vulnerable information flows in an application, the method comprising:
-
performing a black-box scan, using a hardware processor, of the application; based on the black-box scan, recording a call-tree representation of a plurality of call stacks arising in the application due to test inputs provided during the black-box scan, the call tree representation indicating paths between the plurality of call stacks; performing, for each of the paths in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, a static analysis, and by the static analysis determining at least one parameter value that, when abstracted, drives execution of the application, via the path in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, to flow to the at least one security sink; responsive to determining that abstracting the first parameter value does not drive execution of the application, via the path in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, to flow to the at least one security sink, abstracting at least a second parameter value, and determining whether abstracting both the first and second parameter values drives execution of the application, via the path in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, to flow to the at least one security sink; and generating a security report that identifies at least one of the paths in the call-tree representation that does not constitute the vulnerable information flow during the black-box scan, but flows to the at least one security sink when both the first and second parameter values are abstracted.
-
Specification