Patent ID: 8316448

Claim:
A method of generating a filter for inputs to a program comprising: generating an execution trace for the program using an exploit for a vulnerability, the execution trace comprising: a list of instructions, the list of instructions including instructions executed from a first time an exploit is received to a time an attack is detected; and a vulnerability point, wherein the vulnerability point represents, from the list of instructions, a particular instruction executed at the time the attack is detected, the particular instruction being a final instruction in the list of instructions; computing an initial set of filter conditions from the execution trace, each filter condition corresponding to an instruction in the execution trace; selecting a subset of the instructions in the execution trace that ensure the vulnerability can be exploited; generating a revised set of filter conditions by removing conditions from the initial set that do not correspond to an instruction in the subset of instructions; generating an alternative exploit based on the revised set of filter conditions, the generating the alternative exploit comprising: allocating a score to each of the revised set of filter conditions; determining a score for each byte in the exploit based at least on the scores allocated to each of the revised set of filter conditions; selecting a byte having a score lower than the score for another of the bytes in the exploit; and generating the alternative exploit by removing or duplicating the selected byte having the lower score; and when the alternative exploit is valid, repeating the method for the alternative exploit.