IP Library Granted Patent US 12,619,739
Granted Patent B2
US 12,619,739 · App. 18/557,027 · Granted May 5, 2026

Detection device, detection method, and detection program

Inventors: Tatsuhiro Aoshima (Tokyo, JP); Toshinori Usui (Tokyo, JP); Yuhei Kawakoya (Tokyo, JP); Makoto Iwamura (Tokyo, JP); Jun Miyoshi (Tokyo, JP)
Assignee: NTT, Inc.
G06F21/577G06F11/3604G06F2221/034
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,619,739
App. No.
18/557,027
Granted
May 5, 2026
Kind
B2
Abstract

An unsafe location enumeration unit ( 131 ) enumerates, based on a code of a program, locations that do not satisfy a predetermined condition indicating that type conversion is safe among locations where a type casting occurs in the program. A context extraction unit ( 132 ) transition an automaton corresponding to the locations enumerated by the unsafe location enumeration unit ( 131 ) and extract a context reaching the locations. A vulnerability verification unit ( 133 ) verifies whether the location extracted by the context extraction unit ( 132 ) satisfies an annotation prepared in advance.

Claims (35)

1 . A detection device comprising a processor configured to execute operations comprising:

enumerating, based on a code of a program, a plurality of locations in the code of the program, wherein the plurality of locations does not satisfy a predetermined condition, and the predetermined condition indicates that type conversion is safe at the plurality of locations where a type casting occurs in the program;

transitioning an automaton corresponding to the plurality of locations, wherein the automaton further includes a first sub automaton specifying a variable included in a conditional expression and a second sub automaton that indicates a structure of the conditional expression;

extracting a context reaching the plurality of location and updates the automaton;

verifying whether a location of the plurality of locations satisfies a predetermined annotation; and

transmitting a result of verifying to an application configured to display the result of verifying the code of the program, wherein the result of verifying describes a type confusion vulnerability of the code of the program.

2 . The detection device according to claim 1 , wherein the enumerating further comprises determining a castable relation and a partial type relation in a casting source type and a casting destination type.

3 . The detection device according to claim 1 , wherein, when a variable appears during extraction of a conditional expression by the first sub automaton, the transitioning the automation further comprises specifying the variable using the second sub automaton, and the second sub automation specifies the variable.

4 . The detection device according to claim 1 , wherein the verifying further comprises verifying whether the location satisfies an annotation described by defining a condition of a union with a tag as a refinement type.

5 . The detection device according to according to claim 1 , wherein the code of the program represents a program code for execution by a computer, and the program code is expressed either in C language or C++ language.

6 . The detection device according to according to claim 1 , wherein the result of verifying indicates a location of type confusion vulnerability of the code of the program.

7 . The detection device according to according to claim 1 , wherein the predetermined annotation indicates a data structure describing a condition of a union with a tag as a refinement type of a code.

8 . A detection method, comprising:

enumerating, based on a code of a program, a plurality of locations in the code of the program, wherein the plurality of locations does not satisfy a predetermined condition, and the predetermined condition indicates that type conversion is safe at the location where a type casting occurs in the program;

transitioning an automaton corresponding to the plurality of locations, wherein the automaton further includes a first sub automaton specifying a variable included in a conditional expression and a second sub automaton that indicates a structure of the conditional expression;

extracting a context reaching the plurality of locations and updates the automaton;

verifying whether a location of the locations satisfies a predetermined annotation; and

transmitting a result of verifying to an application configured to display the result of verifying the code of the program, wherein the result of verifying describes a type confusion vulnerability of the code of the program.

9 . The detection method of claim 8 , wherein the enumerating further comprises determining a castable relation and a partial type relation in a casting source type and a casting destination type.

10 . The detection method of claim 8 , wherein, when a variable appears during extraction of a conditional expression by the first sub automaton, the transitioning the automation further comprises specifying the variable using the second sub automaton, and the second sub automation specifies the variable.

11 . The detection method of claim 8 , wherein the verifying further comprises verifying whether the location satisfies an annotation described by defining a condition of a union with a tag as a refinement type.

12 . The detection method of claim 8 , wherein the code of the program represents a program code for execution by a computer, and the program code is expressed either in C language or C++ language.

13 . The detection method of claim 8 , wherein the predetermined annotation indicates a data structure describing a condition of a union with a tag as a refinement type of a code, and the result of verifying indicates a location of type confusion vulnerability of the code of the program.

14 . A computer-readable non-transitory recording medium storing computer-executable program instructions that when executed by a processor cause a computer to execute operations comprising:

enumerating, based on a code of a program, a plurality of locations in the code of the program, wherein the plurality of locations does not satisfy a predetermined condition, and the predetermined condition indicates that type conversion is safe at the plurality of locations where a type casting occurs in the program;

transitioning an automaton corresponding to the plurality of locations, wherein the automaton further includes a first sub automaton specifying a variable included in a conditional expression and a second sub automaton that indicates a structure of the conditional expression;

extracting a context reaching the plurality of location and updates the automaton; and

verifying whether a location of the plurality of locations satisfies a predetermined annotation; and

transmitting a result of verifying to an application configured to display the result of verifying the code of the program, wherein the result of verifying describes a type confusion vulnerability of the code of the program.

15 . The computer-readable non-transitory recording medium according to claim 14 , wherein the enumerating further comprises determining a castable relation and a partial type relation in a casting source type and a casting destination type.

16 . The computer-readable non-transitory recording medium according to claim 14 , wherein, when a variable appears during extraction of a conditional expression by the first sub automaton, the transitioning the automation further comprises specifying the variable using the second sub automaton, and the second sub automation specifies the variable.

17 . The computer-readable non-transitory recording medium according to claim 14 , wherein the verifying further comprises verifying whether the location satisfies an annotation described by defining a condition of a union with a tag as a refinement type.

18 . The computer-readable non-transitory recording medium according to claim 14 , wherein the code of the program represents a program code for execution by a computer, and the program code is expressed either in C language or C++ language.

19 . The computer-readable non-transitory recording medium according to claim 14 , wherein the predetermined annotation indicates a data structure describing a condition of a union with a tag as a refinement type of a code.

20 . The computer-readable non-transitory recording medium according to claim 14 , wherein the result of verifying indicates a location of type confusion vulnerability of the code of the program.

Assignments (2)
CHANGE OF NAME Recorded Jan 1, 2026
From: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
To: NTT, INC.
Reel/Frame 074164/0725 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Oct 24, 2023
From: AOSHIMA, TATSUHIRO; USUI, TOSHINORI; KAWAKOYA, YUHEI; IWAMURA, MAKOTO; MIYOSHI, JUN
To: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
Reel/Frame 065328/0652 →
Continuity (1)
Related Publication 20240370571A1 · Nov 7, 2024
References Cited (14)
US 11860996B1 · Pizlo · 2024 [cited by examiner]
US 20030097581A1 · Zimmer · 2003 [cited by examiner]
US 20040117746A1 · Narain · 2004 [cited by examiner]
US 20100169868A1 · Condit · 2010 [cited by examiner]
US 20120254827A1 · Conrad · 2012 [cited by examiner]
US 20120254830A1 · Conrad · 2012 [cited by examiner]
US 20190121716A1 · Kurmus · 2019 [cited by examiner]
Haller et al. “TypeSan: Practical Type Confusion Detection”, ACM, 2016, pp. 517-528. (Year: 2016). [cited by examiner]
Chen et al. “MOPS: an Infrastructure for Examining Security Properties of Software”, CCS'02 Nov. 18-22, 2002, pp. 235-244. (Year: 2002). [cited by examiner]
Jhala et al. (2007) “State of the Union: Type Inference via Craig Interpolation” TACAS, Mar. 9, 2007, pp. 553-567. [cited by applicant]
Chandra et al. (1999) “Physical Type Checking for C” Bell Laboratories Technical Report, Mar. 22, 1999, pp. 1-26. [cited by applicant]
Chugh et al. (2012) “Nested Refinements: A Logic for Duck Typing” POPL'12, Jan. 25, 2012, pp. 231-241. [cited by applicant]
Diwan et al. (1998) “Type-Based Alias Analysis” SIGPLAN '98, May 1, 1998, pp. 106-117. [cited by applicant]
Chugh et al. (2011) “Nested Refinements for Dynamic Languages” arXiv, Sep. 15, 2011. [cited by applicant]