Veracode, Inc.

Christopher J Wysopal

Christopher J Eng

Matthew P Moynahan

Nelson Roberto Manohar-Alers

Theodora Heather Titonis

Simeon Simeonov

Malcolm W Lockhart

Jon R Stevenson

Nelson R Manohar-Alers

Theodora H Titonis

At least a static analysis and a dynamic analysis to perform for a first software application are determined based, at least in part, on a profile of the first software application. The first software application is analyzed with the static analysis to generate static analysis results. The first software application is analyzed with dynamic analysis to generate dynamic analysis results. An assessment report is generated based on the static analysis results and the dynamic analysis results, wherein the assessment report indicates a security score of the first software application that is based, at least in part, on the static analysis results and the dynamic analysis results.

Assessment and analysis of software security flaws

Security analysis and vulnerability testing results are 'packaged' or 'bound to' the actual software it describes. By linking the results to the software itself, downstream users of the software can access information about the software, make informed decisions about implementation of the software, and analyze the security risk across an entire system by accessing all (or most) of the reports associated with the executables running on the system and summarizing the risks identified in the reports.

A method comprises, based on receiving a request to analyze at least a first mobile application, scheduling the request for a first sandbox. The first mobile application is analyzed based on the request, wherein the analysis of the first mobile application comprises performing a behavioral analysis of the first mobile application within the first sandbox and performing a static analysis of the first mobile application. A first feature vector is generated based on data resulting from the analysis of the first mobile application. The first mobile application is determined to comprise malware based, at least in part, on comparing the first feature vector with at least a second feature vector, wherein the second feature vector was generated based on at least one of a static analysis and a behavioral analysis of malware.

Automated behavioral and static analysis using an instrumented sandbox and machine learning classification for mobile security

The present system includes a computer-networked system that allows mobile subscribers, and others, to submit mobile applications to be analyzed for anomalous and malicious behavior using data acquired during the execution of the application within a highly instrumented and controlled environment for which the analysis relies on per-execution as well as comparative aggregate data across many such executions from one or more subscribers.

Assessment and analysis of software security flaws in virtual machines

Security assessment and vulnerability testing of software applications is performed based at least in part on application metadata in order to determine an appropriate assurance level and associated test plan that includes multiple types of analysis. Steps from each test are combined into a 'custom' or 'application-specific' workflow, and the results of each test may then be correlated with other results to identify potential vulnerabilities and/or faults.

Growing community of inventors

Concord, MA, United States of America

Christopher J Wysopal