Granted Patent B1

US 9,230,099 · App. 14/231,663 · Granted Jan 5, 2016

Abstract

Claims (79)

1. A computer-implemented method for combining static and dynamic code analysis, at least a portion of the method being performed by a computing system comprising at least one computer processor, the method comprising:

identifying, as part of a process for evaluating executable code for compliance with at least one data loss prevention policy, executable code that is to be analyzed to determine whether the executable code is capable of leaking sensitive data;

performing a static analysis of the executable code to identify one or more objects comprising at least one inter-process communication channel which the executable code may use to transfer sensitive data between two or more software applications that use the at least one inter-process communication channel;

using a result of the static analysis to tune a dynamic analysis by instrumenting the executable code to track access to the one or more objects identified during the static analysis;

performing the dynamic analysis by, while the executable code is being executed, tracking the one or more objects identified during the static analysis to determine whether the executable code leaks sensitive data via the one or more objects identified during the static analysis.

2. The computer-implemented method of claim 1 , wherein:

the one or more objects identified during the static analysis comprise at least one storage location;

instrumenting the executable code comprises monitoring data written to and read from the at least one storage location.

3. The computer-implemented method of claim 2 , wherein the at least one storage location comprises at least one of:

a file;

a database;

a DALVIC bytecode content provider.

4. The computer-implemented method of claim 1 , wherein:

the executable code comprises:

a first software application that can access sensitive data; and

a second software application that can transmit sensitive data outside a computing system that hosts the first software application and the second software application;

identifying the executable code comprises identifying the inter-process communications channel that the first software application may use to transfer sensitive data to the second software application;

instrumenting the executable code comprises tracking sensitive data transferred between the first software application and the second software application using the inter-process communications channel.

5. The computer-implemented method of claim 1 , wherein the at least one inter-process communication channel comprises at least one of:

a named pipe;

a message passing;

synchronization;

shared memory;

a copy and paste function;

a clipboard;

a remote procedure call.

6. The computer-implemented method of claim 1 , wherein identifying the executable code comprises at least one of:

identifying the executable code during development of the executable code;

identifying the executable code as part of a process for evaluating the executable code within a particular computing environment;

identifying the executable code while the executable code is running.

7. The computer-implemented method of claim 1 , wherein the at least one data loss prevention policy is configured to prevent sensitive information from leaking.

8. A system for combining static and dynamic code analysis, the system comprising:

an identification module programmed to identify, as part of a process for evaluating executable code for compliance with at least one data-loss prevention policy, executable code that is to be analyzed to determine whether the executable code is capable of leaking sensitive data;

a static analyzer programmed to perform a static analysis of the executable code to identify one or more objects comprising at least one inter-process communication channel which the executable code may use to transfer sensitive data between two or more software applications that use the at least one inter-process communication channel;

a tuning module programmed to use a result of the static analysis to tune a dynamic analysis by instrumenting the executable code to track access to the one or more objects identified during the static analysis;

a dynamic analyzer programmed to perform the dynamic analysis by, while the executable code is being executed, tracking the one or more objects identified during the static analysis;

at least one computer processor configured to execute the identification module, the static analyzer, the tuning module, and the dynamic analyzer.

9. The system of claim 8 , wherein:

the executable code comprises a single software application;

the one or more objects identified during the static analysis comprise objects to which the single software application may write to and read from.

10. The system of claim 8 , wherein:

the one or more objects identified during the static analysis comprise at least one storage location;

the tuning module instruments the executable code by monitoring data written to and read from the storage locations.

11. The system of claim 8 , wherein:

the executable code comprises a plurality of software applications;

the one or more objects identified during the static analysis comprise one or more storage locations that each software application within the plurality of software applications may access.

12. The system of claim 8 , wherein:

the executable code comprises a plurality of software applications;

the one or more objects identified during the static analysis comprise one or more inter-process communication channels that may transfer sensitive information between two or more software applications within the plurality of software applications.

13. The system of claim 8 , wherein:

the executable code comprises:

a first software application that can access sensitive data; and

a second software application that can transmit sensitive data outside a computing system that hosts the first software application and the second software application;

the identification module identifies the executable code at least in part by identifying the inter-process communications channel that the first software application may use to transfer sensitive data to the second software application;

the tuning module instruments the executable code at least in part by tracking sensitive data transferred between the first software application and the second software application using the inter-process communications channel.

14. The system of claim 8 , wherein the tuning module instruments the executable code by at least one of:

inserting analysis code into the executable code inline;

using static binary instrumentation to instrument the executable code before the executable code is run;

using dynamic binary instrumentation to inject analysis code into the executable code while the executable code is running.

15. A non-transitory computer-readable medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

identify, as part of a process for evaluating executable code for compliance with at least one data-loss prevention policy, executable code that is to be analyzed to determine whether the executable code is capable of leaking sensitive data;

perform a static analysis of the executable code to identify one or more objects comprising at least one inter-process communication channel which the executable code may use to transfer sensitive data between two or more software applications that use the at least one inter-process communication channel;

use a result of the static analysis to tune a dynamic analysis by instrumenting the executable code to track access to the one or more objects identified during the static analysis;

perform the dynamic analysis by, while the executable code is being executed, tracking the one or more objects identified during the static analysis to determine whether the executable code leaks sensitive data via the one or more objects identified during the static analysis.

16. The non-transitory computer-readable medium of claim 15 , wherein:

the one or more objects identified during the static analysis comprise at least one storage location;

the one or more computer-executable instructions instrument the executable code by monitoring data written to and read from the at least one storage location.

17. The non-transitory computer-readable medium of claim 15 , wherein the one or more computer-executable instructions further perform the static analysis by at least one of:

performing a data-flow analysis to gather information relating to the executable code;

using a control flow graph of the executable code to determine parts of the executable code to which a particular value assigned to a variable potentially propagates.

18. The non-transitory computer-readable medium of claim 15 , wherein the one or more computer-executable instructions identify the executable code by:

identifying a first software application that is capable of accessing sensitive data;

identifying a second software application that is capable of transferring the sensitive data outside a computing system comprising the second software application, wherein the executable code comprises the first and second software application.

19. The non-transitory computer-readable medium of claim 18 , further comprising:

identifying the executable code at least in part by identifying the inter-process communications channel that the first software application may use to transfer sensitive data to the second software application;

instrumenting the executable code at least in part by tracking sensitive data transferred between the first software application and the second software application using the inter-process communications channel.

20. The non-transitory computer-readable medium of claim 15 , wherein the executable code comprises at least one of:

JAVA bytecode;

DALVIK bytecode.

Assignments (6)