Abstract: A method includes receiving executable binary code and a machine-readable specification that (1) defines a control flow pattern and a dataflow constraint and (2) is associated with a library function call. A target of a library function call site is retrieved, the library function call site being associated with the library function call and included in the executable binary code. An indication of an execution path in the executable binary code is identified based on the control flow pattern the target. An argument of the library function call is identified based on the dataflow constraint, the target, and the indication of the execution path. The method also includes determining, using solver software, that the argument satisfies the dataflow constraint defined by machine-readable specification. In response to the determining, a signal that indicates that the executable binary code is associated with a predetermined software action is transmitted.

Abstract: A non-transitory processor-readable medium stores code representing instructions to be executed by one or more processors, and the instructions include code to cause the one or more processors to (1) receive executable binary code and a specification that defines a constraint and (2) generate a predicate set. The code also causes the one or more processors to identify an argument of a function to be called by the executable binary code, the argument identified based on a map. A constrained predicate set is generated based on the predicate set and the machine-readable specification and, using solver software, the code causes the one or more processors to determine that the argument satisfies the constraint based on the constrained predicate set. A signal that indicates that the executable binary code is associated with a predetermined software action is generated in response to determining the argument satisfies the constraint.

Abstract: A method includes receiving, at a processor, (1) machine-readable binary code to be executed at a target processor and (2) a machine-readable control flow pattern that includes one or more library function calls. The method also includes identifying, via the processor, an indication of an execution path in the machine-readable binary code based on the machine-readable control flow pattern. The method also includes transmitting, via the processor, a signal that indicates that the machine-readable binary code includes the one or more library function calls included in the machine-readable control flow pattern.

Abstract: A wireless intrusion detection system (WIDS) is disclosed for monitoring both authorized and unauthorized access to a wireless portion of a network. The WIDS consists of a collector and one or more nodes that communicate via an out of band means that is separate from the network. Unauthorized access points and unauthorized clients in the network can be detected. The WIDS can be used to monitor, for example, a network implemented using the 802.11 protocol. In addition, the WIDS can be used by one company to provide a service that monitors the wireless network of another company.

Abstract: A wireless intrusion detection system (WIDS) is disclosed for monitoring both authorized and unauthorized access to a wireless portion of a network. The WIDS consists of a collector and one or more nodes that communicate via an out of band means that is separate from the network. Unauthorized access points and unauthorized clients in the network can be detected. The WIDS can be used to monitor, for example, a network implemented using the 802.11 protocol. In addition, the WIDS can be used by one company to provide a service that monitors the wireless network of another company.