Microsoft Technology Licensing, LLC

John Robert Lambert

Giovanni Moises Della-Libera

Vijay Gajjala

Tomasz Janczuk

Kenneth David Wolf

Amar Dinesh Patel

Geoffrey M Kizer

Elliot Lee Waingold

Nitin Kumar Goel

Potentially malicious uniform resource locators and websites are safely and effectively investigated through live forensic browsing. Live data from an isolated browser feeds a security information and event management (SIEM) tool and other forensic tools during a browsing session, allowing investigators to direct the browsing in response to analysis results. Session data may be translated for SIEM ingestion. Browsing sessions may be manually or automatically customized to obscure their forensic nature, by routing selection, by bandwidth or latency adjustment, or by spoofing externally detectable characteristics such as geolocation, user agent, time zone, and language. Forensic activity by an investigator may also be obscured from discovery by an attacker as a result of spoofing the browser's context, such as plugin status and host machine physical characteristics. Human presence tests relied on by attackers may be satisfied without sacrificing a targeted system's cybersecurity or an investigator's access to forensic tools.

Live forensic browsing of URLs

Embodiments described herein are directed to allowing a user to extend the functionality of a software code interpretation system. In one embodiment, a computer system receives user-defined conversion rules from a user for converting dynamic language code to continuation-based abstract memory representations. The computer system identifies portions of software code that are to be converted from dynamic language abstract memory representations into continuation-based abstract memory representations, where the identified code portions include undefined, extensible input primitives. The computer system also generates a dynamic, extensible set of output primitives interpretable by a continuation-based code interpretation system using the received conversion rules and converts the identified code portions including the undefined, extensible input primitives from dynamic language abstract memory representations into continuation-based abstract memory representations using the generated set of output primitives.

Customizable dynamic language expression interpreter

A security system with a mechanism to identify types of information that need to be secured and another mechanism to specify how the types are to be secured. The system includes a sender having an application and a receiver having a security module and one or more datastores to store information related to types of information that need to be secured (e.g. 'scopes'), how information is to be secured (e.g., 'profiles'), and a mapping (e.g., &#x201c;bindings&#x201d;) between the scopes and profiles. Scopes can be implemented by application developers. Profiles can be implemented by application deployers and/or administrators. The security module determines which scope is appropriate for the message, and then determines the profile that is mapped to the scope. The security module can then make an access control decision using the profile.

Security scopes and profiles

A system for processing multiple types of security schemes includes a server having a claims engine that extracts claim(s) from security token(s) and maps extracted claims to other claims. The term claim as used in this context is a statement about a token's subject. The claims engine can extract claim(s) from one or more different types of security tokens corresponding to the multiple security schemes. These extracted claim(s) can then be selectively mapped to other claims using mapping information that is accessible to the server. The security decision can then be based on the extracted and/or derived claim(s) rather than tokens. This system can thereby support multiple security schemes and simplify the security process for the user.

Generic security claim processing model

Computerized testing of a system to identify combinations of input values that expose failures in the system's operation. Attributes are applied to fields in a source code version of a test case template corresponding to the object. Applied attributes can indicate fields that are to be used when generating test cases for the object. The source code version of the test case template is subsequently compiled or interpreted into a binary test case template. Metadata in the binary test case template is inspected (e.g., through reflection) to identify the fields, data types, and attributes that are to be used when generating test cases. Based on possible input values for the identified fields and generation rules, a plurality of test cases is generated. The generated test cases are executed to identify combinations of input values that expose failures in the system's operation.

Automatic identification of input values that expose output failures in a software object

Computerized testing of an object to identify one or more call sequences that give rise to exceptions. A set of potential operations (consisting of methods and associated parameter values) is automatically generated. A parameter generator may supply interesting parameter values that may more likely result in a thrown exception. A number of call sequences is automatically constructed using the operations in the set of operations as steps in the sequence. Each call sequence is then executed using a new instance of the object. If an exception is thrown, a report may be issued containing information helpful in evaluating whether the exception is appropriate. This information might include the exception type as well as the invalid call sequence that gave rise to the thrown exception. The invalid call sequence may also be minimized to assist the tester in evaluating the root cause and appropriateness of the exception.

Growing community of inventors

Bellevue, WA, United States of America

John Robert Lambert