Apparatus and method for testing secure software

• US 20050273859A1
• Filed: 12/10/2004
• Published: 12/08/2005
• Est. Priority Date: 06/04/2004
• Status: Abandoned Application

• Current Assignee: Fortify Software, Inc. (HP Inc.)
• Original Assignee: Fortify Software, Inc. (HP Inc.)
• Inventors: Chess, Brian, Thornton, Roger, Fay, Sean, Do, Arthur
• Application Number:
  US11/009,474
• Publication Number:
  US 20050273859A1
• Time in Patent Office: Days
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

A computer readable medium includes executable instructions to analyze program instructions for security vulnerabilities. Executable instructions identify potential security vulnerabilities within program instructions based upon input from an attack database and information derived during a static analysis of the program instructions. Vulnerability tests are applied to the program instructions in view of the security vulnerabilities. Performance results from the vulnerability tests are analyzed. The performance results are then reported.

Claims

1. A computer readable medium including executable instructions to analyze program instructions for security vulnerabilities, comprising executable instructions to:

identify potential security vulnerabilities within program instructions based upon input from an attack database and information derived during a static analysis of said program instructions;

apply vulnerability tests to said program instructions in view of said security vulnerabilities;

analyze performance results from said vulnerability tests; and

report said performance results.

2. The computer readable medium of claim 1 wherein said executable instructions to identify potential security vulnerabilities include executable instructions to process security rules.

3. The computer readable medium of claim 2 further comprising executable instructions to periodically update said attack database and said security rules from a remote computer.

4. The computer readable medium of claim 1 wherein said executable instructions to identify include executable instructions to utilize user-configurable security test rules to identify potential security vulnerabilities.

5. The computer readable medium of claim 1 wherein said executable instructions to apply vulnerability tests include executable instructions to apply attacks to input fields, cookies, and headers associated with said program instructions.

6. The computer readable medium of claim 1 wherein said executable instructions to report include executable instructions to report said performance results to a security monitoring module.

7. The computer readable medium of claim 1 wherein said executable instructions to report include executable instructions to report said performance results as a script to be executed by a test application.

8. The computer readable medium of claim 1 further comprising executable instructions to perform a static analysis of said program instructions, said executable instructions to perform a static analysis including executable instructions to:

convert diverse program instruction formats to a common format;

derive a system model from said common format; and

perform a static analysis on said system model to identify security vulnerabilities.

9. The computer readable medium of claim 8 wherein said executable instructions to perform a static analysis include executable instructions to perform a static analysis selected from a static data flow analysis, a lexical analysis, a semantic analysis, and a program control flow analysis.

10. A method of analyzing program instructions for security vulnerabilities, comprising:

identifying potential security vulnerabilities within program instructions based upon input from an attack database and information derived during a static analysis of said program instructions;

applying vulnerability tests to said program instructions in view of said security vulnerabilities;

analyzing performance results from said vulnerability tests; and

reporting said performance results.

11. The method of claim 10 wherein identifying potential security vulnerabilities includes processing security rules.

12. The method of claim 11 further comprising periodically updating said attack database and said security rules from a remote computer.

13. The method of claim 10 wherein identifying potential security vulnerabilities includes utilizing user-configurable security test rules to identify potential security vulnerabilities.

14. The method of claim 10 wherein applying vulnerability tests includes applying attacks to input fields, cookies, and headers associated with said program instructions.

15. The method of claim 10 wherein reporting includes reporting said performance results to a security monitoring module.

16. The method of claim 10 wherein reporting includes reporting said performance results as a script to be executed by a test application.

17. The method of claim 10 further comprising performing a static analysis of said program instructions, said static analysis including:

converting diverse program instruction formats to a common format;

deriving a system model from said common format; and

performing a static analysis on said system model to identify security vulnerabilities.

18. The method of claim 17 wherein performing a static analysis includes performing a static analysis selected from a static data flow analysis, a lexical analysis, a semantic analysis, and a program control flow analysis.