International Business Machines Corporation

Pietro Ferrara

Omer Tripp

Marco Pistoia

Petar Tsankov

Matthias Daniel Dietsch

Julian Timothy Dolby

Lucas Brutschy

David M Lubensky

John J Ponzo

Luciano Bello

Eunho Yang

Pascal Roos

Techniques for facilitating incremental static program analysis based on machine learning techniques are provided. In one example, a system comprises a feature component that, in response to an update to a computer program, generates feature vector data representing the update, wherein the feature vector data comprises feature data representing a feature of the update derived from an abstract state of the computer program, and wherein the abstract state is based on a mathematical model of the computer program that is generated in response to static program analysis of the computer program. The system can further comprise a machine learning component that employs a classifier algorithm to identify an affected portion of the mathematical model that is affected by the update. The system can further comprise an incremental analysis component that incrementally applies the static program analysis to the computer program based on the affected portion.

Machine learning to facilitate incremental static program analysis

An apparatus, method and computer program product for repairing security vulnerabilities of an application running on a mobile device. The method comprises: monitoring, by a hardware processor running a mobile device application, an application program interface (API) request associated with a data access operation, the data access operation associated with a security vulnerability. The method determines one or more private values provided by the data access operation and tracks, for each determined private value, a use of the private value by the mobile device application. Further, the method determines from the tracked usage, whether a private value has been transformed in a manner associated with the security vulnerability. For each private value that has been transformed, using the processor to modify the private value deemed a security vulnerability prior to an access by the mobile device application.

Value based information tracking for security enforcement

A fine grained permission method and system that parameterizes permissions based on an objective criterion. The method includes accessing libraries of application programs requiring a permission, automatically extracting types of the parameters and respective corresponding fields read by the libraries requiring the permission, filtering the extracted types of parameters and fields based on a usage criteria to determine a filtered type of parameter and field for the permission and storing the filtered type parameter and field for the permission in a database. A request for a permission is passed to a fine grained permission module which obtains the filtered type of parameter and field for the permission, determines a specific parameter for the permission based on the filtered type of parameter and field and parameterizes the permission using the specific parameter. Downloading of the application program is completed by limiting the permission based on the specific parameter.

System, method and apparatus for extracting usage-based fine grained permissions

A method and system of protecting user sensitive information from an application program of a user device are provided. The application program to be installed is received on the user device. Permissions to resources of the user device for the application program are identified. For each permission, mapping the permission to one or more sections of a code of the application program. For each mapped section of the code, a recipient of user sensitive information facilitated by the permission is determined. For each recipient, it is determined whether the recipient should be restricted. Upon determining that the recipient should not be restricted, the user sensitive information facilitated by the permission is provided to the recipient. However, upon determining that the recipient should be restricted, alternate information to the recipient.

User device privacy protection

A system and method whereby permission is accessed that is to be revoked for an application. The permission involves access to private data of a user via an API of an OS. It is determined, in the application, program point(s) involving access to the private data of the user via the API. For each selected one of the program point(s), code in the application is rewritten to replace a source statement, at the selected program point, that accesses the private data with another statement that allocates a mock object or value based on a type of an actual value returned by the source statement. The mock object or value does not expose the private data of the user. The application with the rewritten code is packaged as an output application able to be subsequently executed by the user, and is output for use by the user.

Fine-grained user control over usages of sensitive system resources having private data with applications in privacy enforcement

Techniques for identifying computer program security access control violations using static program analysis are provided. In one example, a computer-implemented method comprises generating, by a device operatively coupled to a processor, a mathematical model of a computer program product, wherein the mathematical model defines data flows through nodes of the computer program product that reach a secure node corresponding to a secure resource. The computer implemented method further comprises evaluating, by the device, a security protocol of the computer program product using static program analysis of the mathematical model to determine whether any of the data flows provides access to the secure node without proceeding through one or more security nodes corresponding to the security protocol, wherein the one or more security nodes are included in the nodes of the computer program product.

Identifying computer program security access control violations using static analysis

A computer system performs tracking of security context for confidential or untrusted values input from sources in an executing application to sinks in the executing application. The security context includes indications of sources and declassifier methods corresponding to the values and has been previously defined prior to the tracking. Prior to release of a selected confidential or untrusted value by a sink in the executing application, security context is fetched for the selected confidential or untrusted value. A selected declassifier method is caused to be used on the selected confidential or untrusted value prior to release of the selected confidential or untrusted value to the sink. The selected declassifier method obfuscates the selected confidential or untrusted value and is selected based on the security context for the selected confidential or untrusted value. The obfuscated confidential or untrusted value is caused to be released to the sink in the executing application.

Light-weight context tracking and repair for preventing integrity and confidentiality violations

Privacy violation detection of a mobile application program is disclosed. Regular histories of the mobile application are mined. A call-graph representation of the mobile application program can be created and sequences of events of interest according to the platform specification of the mobile application can be collected. A plurality of learnable features are extracted from the regular histories. The plurality of learnable features are combined into a single feature vector which is fed into a machine-learning-based classification algorithm. Whether the mobile application program includes one or more permissions for accessing unauthorized privacy data of a mobile application user is determined based on a machine learning classification of the single feature vector. The collected sequences can be reduced into a plurality of feature vectors which can include at least one of a happens-before feature and a multiplicity of occurrences feature.

Privacy detection of a mobile application program

A method, system and computer readable program product for cooperative modifying of a software program. In an embodiment, the invention provides a method comprising monitoring two or more running executions of the same software program at two or more user computer systems; detecting an issue with one of the executions; suspending the running executions of the software program; determining a fix to the software program; modifying the software program with the fix on the two or more user computer systems; and resuming the running executions of the software program. In an embodiment, the executions are run at one server computer; and modifying the software program with the fix comprises performing one server instance update to modify all the running executions of the software program with the fix. In an embodiment, the method further comprises issuing notifications to users that the software program has been modified with the fix.

Cooperative updating of software

A method, system, and apparatus configured to identify discriminating features in a plurality of applications, determine via code analysis, when a first application is subjected to classification, positions of the first application's code that correspond to the discriminating features, and forward to a classification algorithm, such that according to its output the code fragments corresponding to the discriminating features are reported.

System, method and apparatus for usable code-level statistical analysis with applications in malware detection

A method, system and computer readable program are disclosed for managing data in a computing network. In an embodiment, the invention provides a method comprising obtaining specified data from a database in the computing network, aggregating the specified data in a defined data structure stored in the computing network, and specifying in the data structure properties over the data aggregated in the data structure. In an embodiment, a plurality of services in the computing network use the data in the data structure in accordance with the properties specified in the data structure. In an embodiment, one or more of the services modifies one or more of the properties specified in the data structure based on a transformation by the one or more of the services of the data aggregated in the data structure.

Data-centric approach to analysis

A method, including identifying over a set of classified applications a set of discriminating features, determining via code analysis, when a first application is subjected to classification, positions of the first application's code that correspond to discriminating features, and forwarding to a classification algorithm, such that according to its output the code fragments corresponding to the discriminating features are reported beyond a determination itself of the discriminating features.

An improved information tracking procedure is provided. A precise information tracking procedure is performed for a sensitive value when an application is predicted to modify the sensitive value prior to the sensitive value reaching a data sink. The sensitive value comprises an attribute that may be linked to external knowledge to reveal sensitive information about an individual. In response to the application not being predicted to modify the sensitive value prior to the sensitive value reaching the data sink, a value-based information tracking procedure is performed. The value-based information tracking procedure comprises storing one or more values that are observed at a data source, and then determining whether or not each of these one or more values are observed at the data sink.

Growing community of inventors

White Plains, NY, United States of America

Pietro Ferrara