Patent ID: 9473523
Filing Date: 2016-10-18
CPC Classification: G06F,H04L

Claim Text:
1. A method of computer security checking, comprising: generating an initial set of candidate test payloads; identifying candidate program points within a given application; instrumenting the given application to generate an instrumented application; executing the instrumented application on a computer processor and tracking execution of the instrumented application; responsive to determining that the instrumented application is receiving an input, binding the input to the initial set of candidate test payloads; at execution points of the instrumented application where the input is constrained via at least one constraint, applying the at least one constraint applied to the input to a payload in the initial set of candidate test payloads; at execution points of the instrumented application where the input is transformed via at least one transformation, applying the at least one transformation to the payload in the initial set of candidate test payloads; responsive to determining that the input satisfies a constraint in the execution points of the instrumented application where the input is constrained but the payload does not constrain the input, removing the payload from the initial set of candidate test payloads; responsive to determining that the execution of the instrumented application reached a security operation, determining whether the initial set of candidate test payloads is empty; responsive to determining that the initial set of candidate test payloads is not empty, establishing that a vulnerability has been detected in the given application; and generating a signal to issue a warning on the computer processor executing the application.