Oracle International Corporation

Sora Bae

Padmanabhan Krishnan

Francois Gauthier

François Gauthier

Cristina Nicole Cifuentes

Raghavendra Kagalavadi Ramesh

Nathan Robert Albert Keynes

Yi Lu

Alexander Jordan

Rebecca Jane O'Donoghue

Kostyantyn Vorobyov

A method may include collecting, by a software agent connected to a target application, a set of observations of executing the target application while in a logging mode. The set of observations identifies instances of operations of the target application. The method may also include transmitting the set of observations to a security service, and receiving an allow list and a confidence estimator model from the security service. The security service generalizes the operations into multiple general operations in the allow list and trains the confidence estimator model based on the set of observations. The method may in addition include transitioning, by the software agent, to a blocking mode, and controlling, according to the allow list and the confidence estimator model, performance by the target application of second instances of second operations while in blocking mode.

Runtime application self-protection

A method for detecting a deserialization attack may include identifying, in a byte stream, a class name corresponding to a class, generating, for the class, a feature vector, generating, by applying a benign deserialization model to the feature vector, a benign probability window, generating, by applying a malicious deserialization model to the feature vector, a malicious probability window, comparing the benign probability window and the malicious probability window to obtain a comparison result, and determining, based on the comparison result, that the class is malicious.

Automatic detection of deserialization attacks with Markov chains

A taint report represents a taint flow from a source value at a source program point to a sink value at a sink program point. Candidate watchpoints that correspond to taint-like values similar to the source value may be inferred from an execution trace. Different subsets of candidate watchpoints represent solutions to the problem of determining an optimal subset of watchpoints contributing to a taint flow. Using a hill-climbing heuristic, incremental improvements are efficiently applied to a solution until no more improvements are found. An objective function may determine whether one solution improves another solution. The objective function may be based on validity, understandability, and performance. Validity favors candidate watchpoints that reduce the edit distance between the source and sink values. Understandability favors candidate watchpoints included in a call chain from the source program point to the sink program point. Performance favors small subsets of candidate watchpoints.

Inferring watchpoints for understandable taint reports

A method for detecting malicious code may include generating, from deserialization examples, a finite automaton including states. The states may include labeled states corresponding to the deserialization examples. A state may correspond to a path from a start state to the state. The method may further include while traversing the states, generating a state mapping including, for the state, a tracked subset of the states, determining that the path corresponds to a path type, inferring, using the path type and the state mapping, a regular expression for the state, and determining, for a new deserialization example and using the regular expression, a polarity indicating whether it is safe to deserialize the new deserialization example.

Synthesis of deserialization filters from positive and negative examples

A method for modifying a call graph may include identifying, in source code, a first call site including a first predicate and a call from a first function to a second function. The first call site may correspond to a first edge of the call graph. The first edge may connect a first node corresponding to the first function and a second node corresponding to the second function. The method may further include modifying the call graph by labelling the first edge with a first encoding of the first predicate, and identifying, in the source code, a second call site including a second predicate and a call from a third function to the first function. The method may further include in response to determining that the first predicate is unsatisfied, modifying the call graph by labelling the second edge with a second encoding of a violation of the first predicate.

Encoding dependencies in call graphs

A method for analyzing a software library may include obtaining the software library, identifying a candidate security-sensitive entity in the software library, and generating a control flow graph that includes execution paths. Each execution path may include a public entry node corresponding to a public entry and a candidate security-sensitive entity node corresponding to the candidate security-sensitive entity. The public entry is a point where an application program external to the software library may access the software library. The method may further include determining whether each execution path in the control flow graph includes a permission check node between the respective public entry node and the candidate security-sensitive entity node in the respective execution path. Each permission check node may correspond to a permission check in the software library. The method may further include classifying, based on the determination, the candidate security-sensitive entity as a security-sensitive entity.

Growing community of inventors

Carindale, Australia

Sora Bae