Abstract: A method and system of determining a vulnerability of software. Libraries are downloaded and stored in a database. For each library, a set of features are extracted and stored in a library index table of the database. For each library, it is determined whether it poses a security concern and flagged accordingly in the library index table. Applications are downloaded and stored in the database. For each application a set of features are extracted and stored in an application index table of the database. For each application, the set of features of the application of the application are compared to the set of features of each of the libraries in the library index table to identify which libraries in the library index table are associated with the application. For each application, a name of the application and names of the associated libraries are stored in a vulnerability reference table in the database.

Abstract: Providing dataflow analysis by selecting a plurality of sampling points from a program under examination. A set of respective values is recorded from a corresponding set of memory registers at each of the plurality of sampling points. The set of respective values comprises at least a first set of values stored in a first set of memory registers for a first sampling point of the plurality of sampling points, and a second set of values stored in a second set of memory registers for a second sampling point of the plurality of sampling points. A correlation is performed between the first set of values and the second set of values to retrieve dataflow information from the program under examination.

Abstract: Preliminary program analysis of an executable may be performed. A security vulnerability level of a portion of the executable may be determined based on the preliminary program analysis. The security vulnerability level of the portion may be compared to a security vulnerability threshold. The precision of runtime monitoring of the portion may be tuned based on the comparison.

Abstract: Gathering coverage metrics for a static analysis procedure by injecting one or more property violations into a program to be examined by the procedure, recording a first list identifying the one or more injected property violations, executing the static analysis procedure to detect at least one of the one or more injected property violations, recording a second list identifying the detected at least one of the one or more injected property violations, and comparing the first list to the second list to gather a set of coverage metrics for the static analysis procedure, The comparing identifies a first set of injected property violations that are not identified by the static analysis procedure, and a second set of injected property violations that are identified by the static analysis procedure. A coverage metrics report is generated that indicates the extent to which the procedure is able to detect vulnerabilities in the program.

Abstract: A hybrid program analysis method includes initiating a static program analysis of an application, generating, by a static program analyzer, a query to a dynamic program analyzer upon determining a code construct of the application requiring dynamic analysis, resolving, by the dynamic program analyzer, the query into a set of arguments with which to invoke the code construct of the application, generating, by the dynamic program analyzer, the set of arguments, invoking, by the dynamic program analyzer, the code construct of the application using set of arguments, answering, by the dynamic program analyzer, the query, and continuing the static program analysis of the application.

Abstract: A computer system performs tracking of security context for confidential or untrusted values input from sources in an executing application to sinks in the executing application. The security context includes indications of sources and declassifier methods corresponding to the values and has been previously defined prior to the tracking. Prior to release of a selected confidential or untrusted value by a sink in the executing application, security context is fetched for the selected confidential or untrusted value. A selected declassifier method is caused to be used on the selected confidential or untrusted value prior to release of the selected confidential or untrusted value to the sink. The selected declassifier method obfuscates the selected confidential or untrusted value and is selected based on the security context for the selected confidential or untrusted value. The obfuscated confidential or untrusted value is caused to be released to the sink in the executing application.

Abstract: Protecting a runtime Web service application. A web service application is instrumented to log its operation and allow recreation of its execution trace. Trace point vulnerabilities are identified using one or more data payloads. Candidate trace point operations associated with the trace point vulnerabilities are identified. Supplementary candidate operations are computed based on the existing trace point operations and the one or more data payloads. The Web service application is further instrumented with the one or more supplementary candidate operations.

Abstract: A method includes receiving from a user via a user interface an activation of at least one element to set a privacy policy specifying the maximum amount of confidential data that is authorized to be leaked to a sink, tracking movement of confidential data through an application, determining based on the tracked movement of the confidential data that the confidential data is leaked to the sink by the application, comparing the confidential data that is leaked to the sink to the specified maximum amount of confidential data that is authorized to be leaked to the sink, and presenting to the user via the user interface an indication of whether the application complies with the privacy policy set by the user based on the comparison.

Abstract: A first application can be presented for installation on a processing system. The first application can be scanned, via a static analysis implemented by a processor, to determine whether a user interface layout of the first application is suspiciously similar to a user interface layout of a second application installed on the processing system. If the user interface layout of the first application is suspiciously similar to the user interface layout of the second application installed on the processing system, the first application can be identified as being unsafe.

Abstract: Protecting a runtime Web service application. A web service application is instrumented to log its operation and allow recreation of its execution trace. Trace point vulnerabilities are identified using one or more data payloads. Candidate trace point operations associated with the trace point vulnerabilities are identified. Supplementary candidate operations are computed based on the existing trace point operations and the one or more data payloads. The Web service application is further instrumented with the one or more supplementary candidate operations.

Abstract: Protecting a runtime Web service application. A web service application is instrumented to log its operation and allow recreation of its execution trace. Trace point vulnerabilities are identified using one or more data payloads. Candidate trace point operations associated with the trace point vulnerabilities are identified. Supplementary candidate operations are computed based on the existing trace point operations and the one or more data payloads. The Web service application is further instrumented with the one or more supplementary candidate operations.

Abstract: A computer system may identify a cryptographic application programming interface (API) call for a program. The cryptographic API call may include a first variable. The computer system may determine that the first variable is a static value. The computer system may tag the first variable. The computer system may determine that the cryptographic API call will be executed. The computer system may replace the first variable with a second variable during execution of the program. The computer system may execute the cryptographic API call with the second variable.

Abstract: A method of collaboratively executing a task using first to N-th mobile devices in an ad-hoc network includes determining collaborative mobile devices out of the second to N-th mobile devices, receiving information corresponding to the collaborative mobile devices, dividing the task into first to M-th sub tasks, assigning each of the first to M-th sub tasks to at least one of the collaborative mobile devices, requesting executions of the first to M-th sub tasks to the collaborative mobile devices, and receiving execution results of the first to M-th sub tasks from the collaborative mobile devices. M and N are integers greater than one.

Abstract: Privacy violation detection of a mobile application program is disclosed. Regular histories of the mobile application are mined. A call-graph representation of the mobile application program can be created and sequences of events of interest according to the platform specification of the mobile application can be collected. A plurality of learnable features are extracted from the regular histories. The plurality of learnable features are combined into a single feature vector which is fed into a machine-learning-based classification algorithm. Whether the mobile application program includes one or more permissions for accessing unauthorized privacy data of a mobile application user is determined based on a machine learning classification of the single feature vector. The collected sequences can be reduced into a plurality of feature vectors which can include at least one of a happens-before feature and a multiplicity of occurrences feature.

Abstract: Preliminary program analysis of an executable may be performed. A security vulnerability level of a portion of the executable may be determined based on the preliminary program analysis. The security vulnerability level of the portion may be compared to a security vulnerability threshold. The precision of runtime monitoring of the portion may be tuned based on the comparison.

Abstract: Performing an automated interaction with a computer software application by identifying, among a plurality of regions of an interface of a computer software application, a region for which a region-level measure exists of user interaction that occurred within the region of the interface, determining if the region-level measure meets or exceeds a predefined minimum level of user interaction, and performing an automated interaction with an element at least partly found within the region if the region-level measure meets or exceeds the predefined minimum level of user interaction.

Abstract: A method, system, and/or computer program product invokes a web service in a software application. A software application comprises a machine readable description of a functionality to be supported by a web service to be invoked, and a machine readable description of an execution instruction for the web service to be invoked. One or more processors determine/identify a web service that supports the functionality to be supported and the execution instruction for the web service to be invoked.

Abstract: Optimizing automated interactions with web pages by identifying, for each of multiple web pages, path information including an incoming hyperlink path having at least one hyperlink, where the incoming hyperlink path leads to the web page, and/or an outgoing hyperlink path having at least one hyperlink, where the outgoing hyperlink path emanates from the web page, determining whether the path information of each of the web pages meets a similarity condition, excluding from an interaction set of the web pages any of the web pages whose path information meets the similarity condition, and causing an automated interaction to be performed with any of the web pages in the interaction set.

Abstract: Identifying whether a first application is malicious. The first application can be presented for installation on a processing system. The first application can be scanned, via a static analysis implemented by a processor, to determine whether a user interface layout of the first application is suspiciously similar to a user interface layout of a second application installed on the processing system. When the user interface layout of the first application is suspiciously similar to the user interface layout of the second application installed on the processing system, an alert can be generated indicating that the first application is malicious.

Abstract: A security analysis of an application is performed by encoding predicates during a first operation by asserting a set of data flow facts comprising a mapping from a variable to a security-relevant substring of a string of the application. A respective truth value is associated with each data flow fact of the set of data flow facts. The set of data flow facts and each truth value are stored in a tangible computer-readable memory device. The truth value of at least one data flow fact of the set of data flow facts is updated in at least one subsequent operation using a set of abstract transformers to eliminate or reduce a security vulnerability in the application.