Oracle International Corporation

Hyunjun Lee

Behnaz Hassanshahi

Francois Gauthier

Alexander Jordan

A method may include generating a callgraph by performing a static analysis of code that includes event handlers, and selecting, using the callgraph, a state of the code, selecting, using the callgraph, an event enabled in the selected state. The event corresponds to an event handler. The method may further include obtaining an input, obtaining a next state by executing the event handler with the obtained input in the selected state, in response to executing the event handler, generating an input modification rule using the obtained input, and generating, using the input modification rule and the obtained input, a modified input that bypasses a guard in the code that controls access to the point of interest.

Guided security analysis

A method may include obtaining, from a runtime system that executes code, a source value at a source point of the code and a sink value at a sink point of the code, identifying a potential taint flow from the source point to the sink point by performing a series of taint inferences that each infer a relationship between the source value and the sink value, and determining whether the potential taint flow is an actual taint flow by performing a series of taint checks that each analyze the execution of the code using the source value and the sink value.

Growing community of inventors

Brisbane, Australia

Hyunjun Lee