Refinement-based security analysis
View Patent ↗A method, computer program product, and computer system for assigning, by a computing device, a value to a first data-flow of a first summary associated with a control flow graph and assigning the value to a second data-flow of a second summary associated with the control flow graph. The first data-flow with the value is identified to flow into a type of sink. The second data-flow with the value is identified not to flow into the type of sink. The first summary of a behavior of the first data-flow is refined in response to identifying that the first data-flow does flow into the type of sink. Refinement of the second summary of a behavior of the second data-flow is skipped in response to identifying that the second data-flow does not flow into the type of sink.
1. A computer program product residing on a non-transitory computer readable storage medium having a plurality of instructions stored thereon which, when executed by a processor, cause the processor to perform operations comprising:
assigning a value to a first data-flow of a first summary associated with a control flow graph and assigning the value to a second data-flow of a second summary associated with the control flow graph;
identifying that the first data-flow with the value does flow into a type of sink, includes identifying that the first data-flow is a security sensitive operation;
identifying that the second data-flow with the value does not flow into the type of sink;
refining the first summary of a behavior of the first data-flow in response to identifying that the first data-flow does flow into the type of sink; and
skipping refinement of the second summary of a behavior of the second data-flow in response to identifying that the second data-flow does not flow into the type of sink; wherein the type of sink includes a security sink.
2. The computer program product of claim 1 wherein the value indicates a skipped summary.
3. The computer program product of claim 1 further comprising refining the first summary of the behavior of the first data-flow a second time.
4. The computer program product of claim 1 wherein the value is assigned from a three value logic.
5. The computer program product of claim 1 further comprising traversing a path of the first data-flow backwards to identify each balanced paths across a method boundary where the first summary uses the value.
6. A computing system including a processor and a memory configured to perform operations comprising:
assigning a value to a first data-flow of a first summary associated with a control flow graph and assigning the value to a second data-flow of a second summary associated with the control flow graph;
identifying that the first data-flow with the value does flow into a type of sink, includes identifying that the first data-flow is a security sensitive operation;
identifying that the second data-flow with the value does not flow into the type of sink;
refining the first summary of a behavior of the first data-flow in response to identifying that the first data-flow does flow into the type of sink; and
skipping refinement of the second summary of a behavior of the second data-flow in response to identifying that the second data-flow does not flow into the type of sink; wherein the type of sink includes a security sink.
7. The computing system of claim 6 wherein the value indicates a skipped summary.
8. The computing system of claim 6 further comprising refining the first summary of the behavior of the first data-flow a second time.
9. The computing system of claim 6 wherein the value is assigned from a three value logic.
10. The computing system of claim 6 further comprising traversing a path of the first data-flow backwards to identify each balanced paths across a method boundary where the first summary uses the value.