Patent ID: 9378385
Filing Date: 2016-06-28
CPC Classification: G06F

Claim Text:
1. A computer-implemented method for determining whether transmission of sensitive data is expected, the method being performed by a computing device comprising at least one hardware processor, the method comprising: identifying a computer program that is to be analyzed to determine whether the computer program unexpectedly transmits sensitive data; determine whether data transmitted by the computer program is consistent with expectations set by a user interface of the computer program by: while the computer program is executing, simulating user input to the computer program by: identifying a user interface element of the computer program; identifying a user input action appropriate for the user interface element of the computer program; identifying an event that results from the user input action in a computing platform on which the computer program is executing; providing the user input action to the user interface element of the computer program; identifying a context of the simulated user input; identifying transmission of sensitive data that occurs after the user input is simulated; determining, based on the context of the simulated user input, whether the transmission of sensitive data is an expected result of the user input; performing a security action with respect to the computer program based on whether the transmission of sensitive data is expected.