Prevoty, Inc.

Imperva, Inc.

Joseph Rozner

Kunal Anand

Richard Meester

Joshua Chase

Michael Crampon

Merritt Carl Vincent

Stephen Weinberg

Martin Ryan

A runtime application self protection (RASP) plug-in logic monitors for, and prevents, outbound network connections that are initiated by server application logic and that are not intended by the application logic. The RASP plug-in has access to information generally available only to the application logic and identifies specific vulnerabilities within the application logic that can be patched. The vulnerabilities are identified by (i) data identifying the portion(s) of the application logic that is the source of the vulnerability and (ii) data identifying the authenticated user, if any, that is the source of the attack. The RASP plug-in catches and identifies specific attacks on the application logic in real-world, production operation.

Monitoring and preventing outbound network connections in runtime applications

Methods and apparatuses for detecting an evaluation flaw in a SQL query, the SQL query configured to access data in a database table are disclosed. The method includes creating a parse tree from the SQL query and evaluating the parse tree to ascertain whether a condition of the SQL query results in a type or value that is independent of contents of the database table. For type evaluation, if, responsive to the evaluating, the condition is found, designating the SQL query at risk for having the tautology in the SQL query. For value evaluation, if, responsive to the evaluating, the condition is found, determining whether the condition is always true or whether the condition is always false; and if, responsive to the determining, the condition is found to be always true or always false, designating the SQL query at risk for having the evaluation flaw in the SQL query.

Systems and methods for SQL value evaluation to detect evaluation flaws

Systems and methods for SQL type evaluation to detect evaluation flaws

The present invention relates to systems and methods for analyzing SQL queries for constraint violations, which may indicate injection attacks. The systems and methods tokenize a SQL query to generate a token stream. Next, lexical nodes are generated by iterating over the token stream. Then, a parse tree can be constructed by iterating over the lexical nodes. The parse tree may be compared to a SQL schema and access configuration for a database in order to analyze the SQL query for constraint violations, including determining the number of queries in the parse tree, identifying invalid fields and table access, identifying invalid field type comparisons and pattern matches, and identifying early statement termination.

Systems and methods for SQL query constraint solving

Growing community of inventors

Northridge, CA, United States of America

Joseph Rozner