International Business Machines Corporation

Ounce Labs, Inc.

John Peyton

Ryan Berg

Robert A Gottlieb

John J Danahy

Larry Rose

Chris Rehbein

Stephen Darwin Teilhet

Kristofer Alyn Duer

Lin Tan

Omer Tripp

Marco Pistoia

Takaaki Tateishi

Shay Artzi

Manu Sridharan

Jason N Todd

Robert Wiener

Jinqiu Yang

Johnathan D Smith

Jinqui Yang

Richard Title

Benjamin Greenwald

Ryan James Berg

Robert Gottlieb

Vulnerability testing of applications may include one or more of identifying a number of paths from a software application being tested, identifying a number of nodes associated with the paths, determining one or more of the paths which share one or more of the nodes, designating the paths which share the nodes as overlapping paths, and displaying the overlapping paths and the shared nodes as an interactive visualization to identify to identify optimal locations to fix one or more vulnerability findings.

Visualization of vulnerabilities detected by static application testing

A source code processing application may process source code and realize the results of the code in a map configuration. In one example, the map may be displayed with a number of stations and pathways between the stations to illustrate associations with classes of the source code. An example method of operation may include one or more of retrieving source code comprising a class from memory, processing the source code to identify an error associated with the class, creating a map with a station linked to the error, and displaying the map on a device.

Visualization of security warning solution points

A method includes determining selected global variables in a program for which flow of the selected global variables through the program is to be tracked. The selected global variables are less than all the global variables in the program. The method includes using a static analysis performed on the program, tracking flow through the program for the selected global variables. In response to one or more of the selected global variables being used in security-sensitive operations in the flow, use is analyzed of each one of the selected global variables in a corresponding security-sensitive operation. In response to a determination the use may be a potential security violation, the potential security violation is reported. Apparatus and computer program products are also disclosed.

Global variable security analysis

Embodiments of the invention describe systems and methods for application level management of virtual address space. A static analysis application can model and analyze a large and complex source code listing to determine whether it has vulnerabilities without exhausting the virtual memory resources provided to it by the operating system. In one embodiment of the invention, the method includes analyzing the source code listing to create a call graph model to represent the expected sequences of routine calls as a result of the inherent control flow of the source code listing. The method also includes monitoring the amount of virtual memory resources consumed by the dynamic state, and swapping out to a storage medium a portion of the dynamic state. The method includes reusing the virtual memory resources corresponding to the swapped out portion of the dynamic state to continue analyzing the source code listing.

Managing memory to support large-scale interprocedural static analysis for security problems

A method and system of detecting vulnerabilities in source code. Source code is parsed into an intermediate representation. Models (e.g., in the form of lattices) are derived for the variables in the code and for the variables and/or expressions used in conjunction with routine calls. The models are then analyzed in conjunction with pre-specified rules about the routines to determine if the routine call posses one or more of pre-selected vulnerabilities.

Method and system for detecting vulnerabilities in source code

Methods and systems of detecting vulnerabilities in source code using inter-procedural analysis of source code. Vulnerabilities in a pre-existing source code listing are detected. The variables in the source code listing are modeled in the context of at least one of the inherent control flow and inherent data flow. The variable models are used to create models of arguments to routine calls in the source code listing. The source code listing is modeled with a call graph to represent routine call interactions expressed in the source code listing. The arguments to routine calls are modeled to account for inter-procedural effects and dependencies on the arguments as expressed in the source code listing.

Method and system for detecting interprocedural vulnerability by analysis of source code

A method and system of detecting vulnerabilities in source code. Source code is parsed into an intermediate representation. Models are derived for the code and the models are then analyzed in conjunction with pre-specified rules about the routines to determine if the routine call posses one or more of pre-selected vulnerabilities.

Method and system for detecting privilege escalation vulnerabilities in source code

A method and system of detecting vulnerabilities in source code. Source code is parsed into an intermediate representation. Models are derived for the code and the models are then analyzed in conjunction with pre-specified rules about the routines to determine if the routines posses one or more of pre-selected vulnerabilities.

Method and system for detecting race condition vulnerabilities in source code

Growing community of inventors

Arlington, MA, United States of America

John Peyton