Oracle International Corporation

Alexander Jordan

Francois Gauthier

Padmanabhan Krishnan

Nicholas John Allen

Behnaz Hassanshahi

Sora Bae

Mahinthan Chandramohan

Christian Humer

Joonyoung Park

Hyunjun Lee

Daniele Bonetta

David Maine

Jacob Kreindl

A method may include determining that a non-constant value of a variable corresponding to a variable node of the abstract syntax tree flows into an operator node in the abstract syntax tree. The method may further include adding, to the abstract syntax tree, a check taint node including functionality to: make a taint status determination that the non-constant value is tainted, and return the non-constant value to the operator node. The operator node generates a result value by executing an operator using the non-constant value. The method may further include adding, to the abstract syntax tree, a set taint node that stores, based on the taint status determination, the result value in a second tainted object, and performing, using the abstract syntax tree, a taint analysis of the source code to identify a vulnerability in the source code.

Dynamic taint tracking in abstract syntax tree interpreters

A taint report represents a taint flow from a source value at a source program point to a sink value at a sink program point. Candidate watchpoints that correspond to taint-like values similar to the source value may be inferred from an execution trace. Different subsets of candidate watchpoints represent solutions to the problem of determining an optimal subset of watchpoints contributing to a taint flow. Using a hill-climbing heuristic, incremental improvements are efficiently applied to a solution until no more improvements are found. An objective function may determine whether one solution improves another solution. The objective function may be based on validity, understandability, and performance. Validity favors candidate watchpoints that reduce the edit distance between the source and sink values. Understandability favors candidate watchpoints included in a call chain from the source program point to the sink program point. Performance favors small subsets of candidate watchpoints.

Inferring watchpoints for understandable taint reports

A method may including obtaining, for an application, an application dependency including called components, and obtaining, using the called components, a component compatibility graph including a set of nodes and a set of edges each connecting a pair of nodes in the set of nodes. The pair of nodes may include a calling node and a called node. Each node may correspond to a component. The method may further include generating, from the component compatibility graph, a set of constraints including a set of edge variables corresponding to the set of edges, selecting, using the set of constraints, an edge subset of the set of edges, and recommending, for the application, an upgrade solution including installing a called component corresponding to a called node connected by an edge in the edge subset.

Upgrading an application using boolean satisfiability solving

A method may include obtaining, from a runtime system that executes code, a source value at a source point of the code and a sink value at a sink point of the code, identifying a potential taint flow from the source point to the sink point by performing a series of taint inferences that each infer a relationship between the source value and the sink value, and determining whether the potential taint flow is an actual taint flow by performing a series of taint checks that each analyze the execution of the code using the source value and the sink value.

Staged dynamic taint flow inference

A method that involves generating, for source code, a set of nodes for a set of statements comprising a first statement and a second statement, wherein each node of the set of nodes comprises a dataflow fact and a statement of the set of statements; identifying a source node and a sink node of the set of nodes; determining that the source node is backward reachable from the sink node by analyzing an incoming access path; and, in response to the determination, identifying a potential taint flow from the source node to the sink node.

Taint analysis with access paths

A method for analyzing a document may include obtaining a runtime model for an application used to process the document, extracting, from the document, code blocks each including statements, and generating, using the runtime model, a result including a series of abstract states for each statement of a code block. Each abstract state may include a series of abstract values each corresponding to concrete values. The method may further include determining, using the result and the runtime model, whether the document includes potentially malicious code.

Detecting malicious code embedded in documents

A method may include initiating a static analysis of code, identifying an opaque function during the static analysis, and modeling the opaque function by: generating, using an abstract state of the static analysis, sample inputs for the opaque function, collecting outputs for the opaque function by executing, using the abstract state, the opaque function with the sample inputs, and updating the abstract state using the outputs.

Growing community of inventors

Brisbane, Australia

Alexander Jordan