Oracle International Corporation

Francois Gauthier

Alexander Jordan

Padmanabhan Krishnan

Behnaz Hassanshahi

Sora Bae

Cristina Nicole Cifuentes

Nicholas John Allen

Raghavendra Kagalavadi Ramesh

Rebecca Jane O'Donoghue

Hyunjun Lee

Trung Quang Ta

Johannes Späth

Antonin Steinhauser

Max Marius Schlüter

Nathan Keynes

A method may include collecting, by a software agent connected to a target application, a set of observations of executing the target application while in a logging mode. The set of observations identifies instances of operations of the target application. The method may also include transmitting the set of observations to a security service, and receiving an allow list and a confidence estimator model from the security service. The security service generalizes the operations into multiple general operations in the allow list and trains the confidence estimator model based on the set of observations. The method may in addition include transitioning, by the software agent, to a blocking mode, and controlling, according to the allow list and the confidence estimator model, performance by the target application of second instances of second operations while in blocking mode.

Runtime application self-protection

A method may include identifying, by executing an application, an entry point corresponding to a Universal Resource Locator (URL) path, extracting, from the application, an entry point declaration corresponding to the entry point, determining, by performing a static analysis starting at the entry point declaration, that a parameter is accessible by the application, and inferring, by the static analysis, a type of the parameter by analyzing usage of the parameter by the application.

Application programming interface specification inference

A taint report represents a taint flow from a source value at a source program point to a sink value at a sink program point. Candidate watchpoints that correspond to taint-like values similar to the source value may be inferred from an execution trace. Different subsets of candidate watchpoints represent solutions to the problem of determining an optimal subset of watchpoints contributing to a taint flow. Using a hill-climbing heuristic, incremental improvements are efficiently applied to a solution until no more improvements are found. An objective function may determine whether one solution improves another solution. The objective function may be based on validity, understandability, and performance. Validity favors candidate watchpoints that reduce the edit distance between the source and sink values. Understandability favors candidate watchpoints included in a call chain from the source program point to the sink program point. Performance favors small subsets of candidate watchpoints.

Inferring watchpoints for understandable taint reports

A method for buffer overflow detection involves obtaining a program code configured to access memory locations in a loop using a buffer index variable, obtaining an assertion template configured to capture a dependency between the buffer index variable and a loop index variable of the loop in the program code, generating an assertion using the assertion template, verifying that the assertion holds using a k-induction; and determining whether a buffer overflow exists using the assertion.

Buffer overflow detection based on a synthesis of assertions from templates and k-induction

A method may include obtaining, from a runtime system that executes code, a source value at a source point of the code and a sink value at a sink point of the code, identifying a potential taint flow from the source point to the sink point by performing a series of taint inferences that each infer a relationship between the source value and the sink value, and determining whether the potential taint flow is an actual taint flow by performing a series of taint checks that each analyze the execution of the code using the source value and the sink value.

Staged dynamic taint flow inference

A method that involves generating, for source code, a set of nodes for a set of statements comprising a first statement and a second statement, wherein each node of the set of nodes comprises a dataflow fact and a statement of the set of statements; identifying a source node and a sink node of the set of nodes; determining that the source node is backward reachable from the sink node by analyzing an incoming access path; and, in response to the determination, identifying a potential taint flow from the source node to the sink node.

Taint analysis with access paths

A method for analyzing a document may include obtaining a runtime model for an application used to process the document, extracting, from the document, code blocks each including statements, and generating, using the runtime model, a result including a series of abstract states for each statement of a code block. Each abstract state may include a series of abstract values each corresponding to concrete values. The method may further include determining, using the result and the runtime model, whether the document includes potentially malicious code.

Detecting malicious code embedded in documents

A method for analyzing code may include generating, via a flow-insensitive points-to analysis, initial interest points each corresponding to a statement in the code, generating, via a flow-sensitive points-to analysis, flow tuples and refined interest points by removing a subset of the initial interest points, and constructing a flow graph using the refined interest points. The flow graph may include nodes each corresponding to a statement in the code, and edges corresponding to the flow tuples. The method may further include identifying a trace through the flow graph. The trace may include a node corresponding to an interest point of the refined interest points.

Staged refinement for static analysis

A method for analyzing code may include determining, using a dependency graph for the code, modules each including function definitions, and generating source points-to tuples and a call graph for a source function definition in a first module. The source points-to tuples may include a source tuple including a source variable and a source allocation site. The source allocation site may be a reference to a location in a memory of a computer system allocated when the source function definition is executed. The method may further include determining, using the call graph and until a fixedpoint condition is triggered, target function definitions reachable from the source function definition, determining that a target summary is stored for a first target function definition, and importing the target summary into a source summary for the source function definition. The source summary may include the source points-to tuples.

Modular points-to analysis

A method for statically analyzing a web application program may include obtaining a control flow graph for the web application program. Each control flow graph node may correspond to a statement in the web application program. The method may further include obtaining a sanitizer sequence including one or more sanitizers followed by an output statement, obtaining a placeholder corresponding to the sanitizer sequence, and generating control flow paths including an output node that corresponds to the output statement. The method may further include generating documents for each control flow path. Each document may include a sanitized value corresponding to the output statement. The method may further include inserting the placeholder into each document at a location of the sanitized value, and reporting a potential cross-site scripting flaw when the sanitizer sequence is insufficient for the output context sequence of the sanitized value.

Growing community of inventors

Brisbane, Australia

Francois Gauthier