Patent ID: 7284274

Claim:
A method for certifying software applications, said method comprising: (a) creating a vulnerability knowledge database comprising one or more classes of known software vulnerabilities; (b) applying a code parser to the software application to create an abstract syntax tree; (c) comparing the abstract syntax tree and the classes of known software vulnerabilities to identify a set of potential exploitable software vulnerabilities; (d) performing a static analysis of the source code, wherein the static analysis is a flow sensitive analysis of a list of constraints, wherein a constraint is a formal assertion describing how a program, function or procedure would affect a state of the software application if the software application were executed, and wherein the results of the static analysis comprise a set of exploitable software vulnerabilities; (e) performing a first dynamic analysis of the software, wherein the first dynamic analysis comprises a set of tests to achieve code coverage; (f) performing a second dynamic analysis of the software, wherein the second dynamic analysis comprises injecting faults into the software while being executed; (g) performing any two of said analysis steps in a pipelined manner; and (h) using the results of steps (a)-(g) as a basis for certifying the software application.