Oracle International Corporation

François Gauthier

Sora Bae

Padmanabhan Krishnan

Scott Gaetjen

Behnaz Hassanshahi

Kostyantyn Vorobyov

Michael Blair

Benjamin Selwyn-Smith

A method for detecting a deserialization attack may include identifying, in a byte stream, a class name corresponding to a class, generating, for the class, a feature vector, generating, by applying a benign deserialization model to the feature vector, a benign probability window, generating, by applying a malicious deserialization model to the feature vector, a malicious probability window, comparing the benign probability window and the malicious probability window to obtain a comparison result, and determining, based on the comparison result, that the class is malicious.

Automatic detection of deserialization attacks with Markov chains

A method for detecting malicious code may include generating, from deserialization examples, a finite automaton including states. The states may include labeled states corresponding to the deserialization examples. A state may correspond to a path from a start state to the state. The method may further include while traversing the states, generating a state mapping including, for the state, a tracked subset of the states, determining that the path corresponds to a path type, inferring, using the path type and the state mapping, a regular expression for the state, and determining, for a new deserialization example and using the regular expression, a polarity indicating whether it is safe to deserialize the new deserialization example.

Synthesis of deserialization filters from positive and negative examples

A method may include extracting, from a document, first content of a first content type and second content of a second content type, deriving first features from the first content and second features from the second content, and generating a first prediction by applying a first supervised model to the first features and a second prediction by applying a second supervised model to the second features. The first supervised model may correspond to the first content type, and the second supervised model may correspond to the second content type. The method may further include combining the first prediction and the second prediction to predict that the document comprises malicious code.

Detection of malware in documents

A method may include sending, to an entry point of an instrumented web application, a first request including a first value of a parameter. The first value may correspond to a first vulnerability category. The method may further include receiving, from the instrumented web application, first taint analysis results, determining that the first taint analysis results include a sink function corresponding to a second vulnerability category, and sending, to the entry point, a second request including a second value of the parameter. The second value may correspond to the second vulnerability category. The method may further include receiving, from the instrumented web application and in response to sending the second request, second taint analysis results including the sink function, and detecting, in the instrumented web application and using the second taint analysis results, a vulnerability corresponding to the sink function and the second vulnerability category.

Growing community of inventors

Brisbane, Australia

François Gauthier