Fireeye, Inc.

Hui Xue

Osman Abdoul Ismael

Dawn Song

Ashar Aziz

Noah M Johnson

Phung-Te Ha

Peter J Gilbert

Prashanth Mohan

Prshanth Mohan

A method is described that includes receiving an application and generating a representation of the application that describes specific states of the application and specific state transitions of the application. The method further includes identifying a region of interest of the application based on rules and observations of the application's execution. The method further includes determining specific stimuli that will cause one or more state transitions within the application to reach the region of interest. The method further includes enabling one or more monitors within the application's run time environment and applying the stimuli. The method further includes generating monitoring information from the one or more monitors. The method further includes applying rules to the monitoring information to determine a next set of stimuli to be applied to the application in pursuit of determining whether the region of interest corresponds to improperly behaving code.

Framework for efficient security coverage of mobile software applications

For one embodiment, a method is described that involves the instrumenting of an application of a computing system with at least one monitoring function, where the monitoring function is capable of operating in a run-time environment during processing of the instrumented application. The movement of data associated with the application is tracked by one or more monitoring functions. This data is at least partially identified by a storage location. Thereafter, a determination is made whether movement of the data from a first storage location to a second storage location is suspicious, and if so, suspicious movement of the data is reported.

Framework for efficient security coverage of mobile software applications using machine learning

A method is described that involves receiving an application and generating a representation of the application that describes states of the application and transitions between the states. The method further includes referring to one or more rules and/or information from an inference engine that is observing the application's run time behavior to identify a region of interest within the application and reaching the region of interest by performing the following: identifying a path from the application's present state to the region of interest; representing states of the application along the path as logic expressions; solving the expressions to generate solutions to the expressions; causing stimuli to be provided to the application, where the stimuli correspond to the solutions.

Framework for efficient security coverage of mobile software applications using symbolic execution to reach regions of interest within an application

A method is described that involves generating one or more machine learned rules with a machine learning system. The method also involves generating a representation of an application that describes various states and state transitions of the application. The method also involves referring to the one or more machine learned rules and the representation to identify a region of interest of the application. The method also involves configuring one or more monitors for the application to be enabled in a run time environment of the application. The method also involves setting conditions of the application within the run time environment to drive the application's execution to the region of interest. The method also involves observing behaviors of the application and determining whether the region of interest corresponds to improperly behaving code.

Growing community of inventors

San Jose, CA, United States of America

Hui Xue