METHOD AND SYSTEM FOR SECURING AGAINST LEAKAGE OF SOURCE CODE

• US 20120042361A1
• Filed: 07/25/2008
• Published: 02/16/2012
• Est. Priority Date: 07/25/2008
• Status: Active Grant

• Current Assignee: Infotect Security Pte Limited
• Original Assignee: Resolvo Systems Pte Limited
• Inventors: Wong, Onn Chee, Loh, Siew Keng, Yang, Hui, Wang, You Liang
• Granted Patent: US 8,732,455 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/12 Protecting executable software
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0245 Filtering by information in the payload
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: Y10S 707/99933 Query processing, i.e. searching

Abstract

Embodiments of the invention provide a method and a system of detecting source code in a message being sent over a digital communication network to secure against unauthorized leakage of source code. The message is intercepted on a network device, placed into a memory on the network device, and divided into one or more segments, wherein each segment includes a predetermined number of lines of text from the message. For each segment, one or more syntax rules of a programming language is applied to the segment and a predetermined number of context lines of text before the segment and/or after the segment, to determine which of the syntax rules of the programming language are matched in the segment. A determination of whether the text message includes source code is provided based on the syntax rules that were matched.

Claims

1. A method of detecting source code in a message being sent over a digital communication network to secure against unauthorized leakage of source code, the method comprising:

intercepting the message on a network device;

placing the message into a memory on the network device;

dividing the message in the memory into one or more segments, each segment including a predetermined number of lines of text from the message;

for each segment, applying one or more syntax rules of a programming language to the segment together with a predetermined number of context lines of text before the segment and/or after the segment, to determine which of the syntax rules of the programming language are matched in the segment; and

providing a determination of whether the message includes source code based on the syntax rules that were matched.

2. The method of claim 1, further comprising applying a sliding window offset to the start of each of the one or more segments, and repeating the application of the one or more syntax rules to each segment.

3. The method of claim 1, wherein an administrator pre-selects the programming language for which the one or more syntax rules are applied to each segment.

4. The method of claim 1, further comprising repeating the application of the one or more syntax rules to each segment for syntax rules of a plurality of programming languages.

5. The method of claim 4, wherein an administrator selects an order in which the plurality of programming languages will have their one or more syntax rules applied to each segment.

6. The method of claim 4, wherein an order in which the plurality of programming languages will have their one or more syntax rules applied to each segment is determined according to a market survey of the popularity of programming languages.

7. The method of claim 1, further comprising providing a coefficient for each of the one or more syntax rules.

8. The method of claim 7, wherein the coefficient for a syntax rule is based at least in part on the uniqueness of that syntax rule in its programming language.

9. The method of claim 7, wherein applying the one or more syntax rules comprises applying the one or more syntax rules in an order based on their coefficients.

10. The method of claim 9, wherein applying the one or more syntax rules comprises applying the one or more syntax rules in an order from highest coefficient to lowest coefficient.

11. The method of claim 7, wherein applying one or more syntax rules comprises computing a product of the coefficient for a syntax rule and the number of characters of text in the segment that match that syntax rule.

12. The method of claim 11, wherein providing the determination of whether the message includes source code comprises computing a ratio based on the product for each syntax rule and the number of characters of text in each segment.

13. The method of claim 12, wherein applying one or more syntax rules stops if the ratio exceeds a predetermined threshold that indicates a likelihood that the message includes source code.

14. The method of claim 1, wherein the message is encoded, and the method further comprises decoding the message.

15. The method of claim 1, further comprising sending an alert message if it is determined that the message includes source code.

16. A system for securing against leakage of source code, the system comprising:

a network device connected to a network, the network device configured to intercept a message on the network and store the intercepted message in a memory on the network device;

the network device further configured to detect source code in the message by;

dividing the message in the memory into one or more segments, each segment including a predetermined number of lines of text;

for each segment, applying one or more syntax rules of a programming language to the segment together with a predetermined number of context lines of text before the segment and/or after the segment, to determine which of the syntax rules of the programming language are matched in the segment; and

providing a determination of whether the message includes source code based on the syntax rules that were matched; and

the network device further configured to take an action to secure against unauthorized leakage of source code if it is determined that the message includes source code.

17. The system of claim 16, wherein the network device is further configured to detect source code in the message by repeating the application of the one or more syntax rules to each segment for syntax rules of a plurality of programming languages.

18. The system of claim 16, wherein the network device is further configured to detect source code in the message by providing a coefficient for each of the one or more syntax rules.

19. The system of claim 18, wherein the network device is further configured to detect source code in the message by providing the coefficient for a syntax rule based at least in part on the uniqueness of that syntax rule in its programming language.

20. The system of claim 18, wherein the network device is further configured to detect source code in the message by applying the one or more syntax rules in an order based on their coefficients.

21. The system of claim 18, wherein the network device is further configured to detect source code in the message by computing a product of the coefficient for a syntax rule and the number of characters of text in the segment that match that syntax rule.

22. The system of claim 21, wherein the network device is further configured to detect source code in the message by computing a ratio based on the product for each syntax rule and the number of characters of text in each segment, and by using the ratio to determine whether the segment contains source code.

23. The system of claim 22, wherein the network device is further configured to detect source code in the message by stopping application of the one or more syntax rules if the ratio exceeds a predetermined threshold that indicates a likelihood that the message includes source code.

24. The system of claim 16, wherein the message is encoded, and wherein the network device is configured to decode the message.

25. The system of claim 16, wherein the action to secure against unauthorized leakage of source code comprises sending an alert message to a device on the network if it is determined that the text message includes source code.