International Business Machines Corporation

Globalfoundries Inc.

Globalfoundries U.S. 2 LLC

Salvatore Angelo Guarnieri

Marco Pistoia

Omer Tripp

Takaaki Tateishi

Julian Timothy Dolby

Stephen Darwin Teilhet

Bard Bloom

John H Field

Frank Tip

Aleksandr Y Aravkin

Shay Artzi

Manu Sridharan

Simon H Jensen

A security analysis of an application is performed by encoding predicates during a first operation by asserting a set of data flow facts comprising a mapping from a variable to a security-relevant substring of a string of the application. A respective truth value is associated with each data flow fact of the set of data flow facts. The set of data flow facts and each truth value are stored in a tangible computer-readable memory device. The truth value of at least one data flow fact of the set of data flow facts is updated in at least one subsequent operation using a set of abstract transformers to eliminate or reduce a security vulnerability in the application.

Developing applications using precise static security analysis

Techniques for generating a warning filter to filter the warnings output from a static program analysis tool are provided. In one example, a computer-implemented method comprises determining feature vector data for a set of warnings, wherein the set of warnings is generated in response to static analysis of a computer program, and wherein the feature vector data comprises a feature vector indicative of an attribute of a warning of the set of warnings. The computer-implemented method also comprises determining a warning filter that identifies a first subset of the set of warnings as representing true positives based on the feature vector data and classified warning data, and wherein the classified warning data represents a second subset of the set of warnings that have been classified to indicate whether respective members of the second subset are indicative of true positives.

Warning filter based on machine learning

An improved static program analysis procedure is provided by formulating a set of seeding configurations, and selecting a subset of queries posed by the static program analysis procedure. In response to one or more queries of the subset of queries being answered positively under at least one configuration of the set of seeding configurations, the one or more queries are determined to be valid queries. Each query of the valid queries is evaluated under each configuration of the set of seeding configurations to determine an accuracy score for each seeding configuration. A seeding configuration having a highest accuracy score is selected as a tool configuration to be used with the static program analysis procedure.

Boosting the efficiency of static program analysis using configuration tuning

An apparatus and computer program product which are configured for determining, as part of a static analysis of a program, links between functions in the program and performing, as part of the static analysis, string analysis on strings used in the program to determine additional links between the functions in the program. The apparatus and computer program product are further configured for outputting, as part of the static analysis, indications of at least the links between the functions and the additional links between the functions.

Enhanced string analysis that improves accuracy of static analysis

User-guided machine learning (ML) significantly reduces false alarms generated by an automated analysis tool performing static security analysis. User interactivity involves initial review and annotation of findings ('witnesses') in a report generated by the analysis tool. Those annotated findings are then used by the system to generate a 'hypothesis' about how to further classify the static analysis findings in the report. The hypothesis is implemented as a machine learning classifier. To generate the classifier, a set of features are abstracted from a typical witness, and the system compares feature sets against one another to determine a set of weights for the classifier. The initial hypothesis is then validated against a second set of user-annotated findings, and the classifier is adjusted as necessary based on how close it fits the new data. Once the approach converges on a final classifier, it is used to filter remaining findings in the report.

Auto-tuning program analysis tools based on user feedback

A method includes reading by a computing system a rule file including one or more rules having specified paths to methods, each method corresponding to one of a sink, source, or sanitizer. The method includes matching by the computing system the methods to corresponding ones of sinks, sources, or sanitizers determined through a static analysis of an application. The static analysis determines at least flows from sources of information to sinks that use the information. The method includes performing by the computing system, using the sinks, sources, and sanitizers found by the matching, a taint analysis to determine at least tainted flows from sources to sinks, wherein the tainted flows are flows passing information to sinks without the information being endorsed by a sanitizer. Apparatus and program products are also disclosed.

Rule matching in the presence of languages with no types or as an adjunct to current analyses for security vulnerability analysis

A hybrid string constructor includes a database configured to store a set of known concretizations. A processor is configured to compare the one or more string components to the set of known concretizations to determine string components from input string information that may be represented concretely, to abstract all string components that could not be represented concretely, and to create a hybrid string representation that includes at least one concrete string component and at least one abstracted string component. The set of known concretizations includes string configurations that cannot be interfered with by an attacker.

Static security analysis using a hybrid representation of string values

Methods for creating a hybrid string representation include determining string components from input string information that may be represented concretely by comparing the one or more components to a set of known concretizations using a processor. The set of known concretizations includes string configurations that cannot be interfered with by an attacker. All string components that could not be represented concretely are abstracted. A hybrid string representation is created that includes at least one concrete string component and at least one abstracted string component.

A computer program to be subjected to static analysis includes at least one framework, in turn including high-level code and at least one configuration file. A specification which describes run-time behavior of the program, including run-time behavior of the at least one framework including the high-level code and the at least one configuration file, is created from the computer program. Based on the specification, synthetic high-level code which accurately simulates the run-time behavior of the at least one framework including the high-level code and the at least one configuration file, without framework usage, is created. Static analysis of the computer program is carried out based on the synthetic high-level code.

Automatic generation of analysis-equivalent application constructs

Systems for constructing hybrid string representations include a string parser configured to parse received string information to produce one or more string components, a database configured to store a set of known concretizations, and a processor configured to compare the one or more string components to the set of known concretizations to determine string components that may be represented concretely, to abstract all string components that could not be represented concretely, and to create a hybrid string representation that includes at least one concrete string component and at least one abstracted string component.

Methods for creating a hybrid string representations include receiving string information as input; parsing the string information to produce one or more string components; determining string components that may be represented concretely by comparing the one or more components to a set of known concretizations; abstracting all string components that could not be represented concretely; and creating a hybrid string representation that includes at least one concrete string component and at least one abstracted string component.

Methods and systems for automatic correction of security downgraders. For one or more flows having one or more candidate downgraders, it is determined whether each candidate downgrader protects against all vulnerabilities associated with the candidate downgrader's respective flow. Candidate downgraders that do not protect against all of the associated vulnerabilities are transformed, such that the transformed downgraders do protect against all of the associated vulnerabilities.

Automatic correction of security downgraders

Systems for automatic correction of security downgraders include a security analysis module configured to perform a security analysis that disregards existing user-provided downgraders to detect flows that are vulnerable; and an enhancer module configured to locate candidate downgraders on the flows, to determine whether each of the candidate downgraders protects against all vulnerabilities associated with each downgrader's respective flow, and to transform candidate downgraders that do not protect against all of the associated vulnerabilities such that the transformed downgraders do protect against all of the associated vulnerabilities.

A method includes a computing system reading a rule file that includes one or more rules having specified paths to methods, such that each method corresponds to one of a sink, source, or sanitizer. The method includes the computing system matching the methods to corresponding ones of sinks, sources, or sanitizers determined through a static analysis of an application. The static analysis determines at least flows from sources of information to sinks that use the information. The method includes the computing system, using the sinks, sources, and sanitizers found by the matching, performing a taint analysis to determine at least tainted flows from sources to sinks, the tainted flows being flows that pass information to sinks without the information being endorsed by a sanitizer. Apparatus and program products are also shown.

Growing community of inventors

New York, NY, United States of America

Salvatore Angelo Guarnieri