The Johns Hopkins University

C Durward McDonell, Iii

David J Heine

J Aaron Pendergrass

Margaret F Lospinuso

Laura J Glendenning

Peter A Loscocco

Bessie Y Lewis

Perry W Wilson

Ryan W Gardner

Douglas Charles Schmidt

Jonathan D Cohen

David R Zaret

Nathan S Reller

Sakunthala Harshavardhana

David P Silberberg

Dennis S Patrone

Benjamin R Salazar

Mark A Thober

Forest C Deal, Jr

Michael D DiRossi

Vina H Nguyen

Yanni A Kouskoulas

David M Patrone

Robert T Hider

A method executable via operation of configured processing circuitry to identify vulnerabilities in program code may include receiving a program and employing a disassembler to disassemble the program, generating a function call tree for the program based on disassembly of the program, receiving an indication of a post condition for which analysis of the program is desired, transforming program statements into logical equations, simplifying the logical equations, propagating post conditions backwards via Dijkstra's weakest precondition variant, analyzing aliases and processing loops to generate a precondition, and using an automated solver to determine whether the precondition is realizable and, if so, providing program inputs required to realize the precondition.

Method and apparatus for automated vulnerability detection

An apparatus for identifying related code variants may include processing circuitry configured to execute instructions for receiving query binary code, processing the query binary code to generate one or more query code fingerprints comprising compressed representations of respective functional components of the query binary code, comparing the one or more query code fingerprints to at least some reference code fingerprints stored in a database to determine a similarity measure between the one or more query code fingerprints and at least some of the reference code fingerprints, and preparing at least one report based on the similarity measure.

Apparatus and method for identifying related code variants in binaries

A method for achieving atomicity while inspecting a running computer process using a copy-on-write process in a supervisor to generate a copy of a target's memory page being written to, prior to executing the write, the copy along with any unwritten to memory pages in the target being mapped to a measurement agent (MA) and used to reflect the state of the target at a particular moment in time which state when observed by the MA provides an atomic runtime inspection.

Methods for improving atomicity of runtime inspections

The present disclosure is directed towards methods and systems and methods for measuring the integrity of an operating system's execution and ensuring that the system's code is performing its intended functionality. This includes examining the integrity of the code that the operating system is executing as well as the data that the operating system accesses. Integrity violations can be detected in the dynamic portions of the code being executed.

Method and system for program execution integrity measurement

Methods and system for program execution integrity measurement

Growing community of inventors

Olney, MD, United States of America

C Durward McDonell, Iii