Systems and methods for determining vulnerable versions of software applications

Abstract

In some aspects, the techniques described herein relate to systems (130) and methods (200; 300) for determining versions of a software application that are affected by a vulnerability including: receiving an indication of a detected vulnerability in a first version of a software application by a computing device (201); in response to the indication of the detected vulnerability, generating a tree representation of the first version of the software application by the computing device (203); retrieving a plurality of versions of the software application by the computing device (301), wherein each of the plurality of version is different than the first version; for each version of the software application of the plurality of versions of the software application, generating a tree representation of the version of the software application by the computing device (303); and based on the generated trees, identifying at least one version of the plurality of versions of the software application that may include the detected vulnerability by the computing device (307).

Description

SYSTEMS AND METHODS FOR DETERMINING VULNERABLE VERSIONS OFSOFTWARE APPLICATIONSSTATEMENT REGARDING FEDERALLY SPONSORED RESEARCH OR DEVELOPMENT

[0001] This invention was made with government support under W911NF2110081 awarded by the United States Army. The government has certain rights in the invention.CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This invention claims priority to US Provisional Patent Application Serial No. 63 / 516,876, filed on August 1, 2023, and titled "FINDING INCONSISTENCIES IN VULNERABILITY REPORTS VIA VULNERABILITY SIGNATURE MATCHING." The contents of which are hereby incorporated by reference.BACKGROUND

[0003] According to the 2023 Open Source Security and Risk Analysis Report, open source programs play a crucial role in the current software development ecosystem, as evident by their presence in 95.8% of scanned codebases. However, research has also shown a reported 33% increase in vulnerabilities targeting open source packages, presenting a severe risk to most organizations.

[0004] In response, the security community has created a robust universal platform for publicly tracking and disclosing vulnerabilities. The ecosystem centers around community appointed CVE Numbering Authorities (CNAs) like MITRE that receive disclosures of new vulnerabilities from researchers, analysts, and developers. CNAs catalog these cases using a standardized Common Vulnerability Enumeration (CVE) naming scheme and publicly broadcast advisories to keep developers and stakeholders informed. CVE advisories are a vital resource for alerting subscribers of severe threats, such as the Log4j2 vulnerability (CVE-2021-44832) that adversely affected Adobe and AWS, among many others.

[0005] Vulnerabilities may stay dormant in code for a long time before being discovered, causing multiple versions to be affected. Consequently, the detailed information provided in CVE advisories is vital for effective decision making. In particular, the affected versions list is essential for informing developers whether their versions of dependencies are vulnerable and require immediate mitigation. Unfortunately, we observe that these lists of affected versions are often incomplete and inaccurate, leading developers astray. For example, CVE-2017-13065 states that there is a null pointer dereference vulnerability in version 1.3.26 of GraphicsMagick. However, our analysis reveals more than 50 additional prior versions that are also affected, but not mentioned.

[0006] A seemingly simple solution to this problem would be to treat all versions prior to the advisory as vulnerable. However, this is neither accurate nor practical to developers that are trying to juggle security maintenance with other important development tasks. The reality is 81.5% of systems contain outdated dependencies because current high-paced development environments prioritize new features over legacy security maintenance, and updating dependencies can alter APIs in ways that require costly code refactoring and testing. Moreover, naively updating dependencies to newer versions can simultaneously mitigate older CVEs while also introducing newer, potentially higher severity, CVEs into the developer's project.

[0007] The current state of the art for statically detecting the presence of vulnerabilities depends largely on having a patch available to identify the bug's root cause. However, even for high-risk vulnerabilities, the average time to develop a patch is 256 days. Thus, a solution for accurate and timely identification of affected versions cannot be dependent on patch availability. Conversely, in order to solve this problem using only dynamic analysis, we would have to assume all versions of the open-source code can be compiled and executed, which is costly and impractical given dependencies older versions can have to old toolchains, user environments, and even kernels. Even binary-only analysis techniques would be hindered by this legacy compilation dependency problem.SUMMARY

[0008] In some aspects, the techniques described herein relate to a method of determining versions of a software application that are affected by a vulnerability including: receiving an indication of a detected vulnerability in a first version of a software application by a computing device; in response to the indication of the detected vulnerability, generating a tree representation of the first version of the software application by the computing device; retrieving a plurality of versions of the software application by the computing device, wherein each of the plurality of version is different than the first version; for each version of the software application of the plurality of versions of the software application, generating a tree representation of the version of the software application by the computing device; and based on the generated trees, identifying at least one version of the plurality of versions of the software application that may include the detected vulnerability by the computing device.

[0009] In some aspects, the techniques described herein relate to a method, wherein generating the tree representation of the first version of the software application includes receiving source code of the first version of the software application and generating the tree representation from the source code.

[0010] In some aspects, the techniques described herein relate to a method, further including: receiving a proof-of-compromise associated with the detected vulnerability for the first version of the software application; executing a taint analysis using the proof of compromise and the first version of the software application to identify portions of the first version of the software application that are associated with the detected vulnerability; and selecting a sub-tree of the tree representation of the first version of the application based on the identified portions of the first version of the software application.

[0011] In some aspects, the techniques described herein relate to a method, wherein identifying portions of the first versions of the software application that are associated with the detected vulnerability includes identifying lines of sourcecode associated with the first version of the software application that are associated with the vulnerability.

[0012] In some aspects, the techniques described herein relate to a method, wherein identifying at least one version of the plurality of versions of the software application that may include the detected vulnerability by the computing device includes: identifying the at least one version of the plurality of versions of the software application that includes a sub-tree that is isomorphic to the selected subtree.

[0013] In some aspects, the techniques described herein relate to a method, wherein generating the tree representation of the version of the software application includes generating an abstract signature tree.

[0014] In some aspects, the techniques described herein relate to a method, wherein the abstract signature tree companies a plurality of nodes and a signature for each node, wherein the signature for a node includes signatures of one or more child nodes of the node from among the plurality of nodes.

[0015] In some aspects, the techniques described herein relate to a system for determining versions of a software application that are affected by a vulnerability including: at least one computing device; and a computer-readable medium with computer-executable instructions stored thereon that when executed by the at least one computing device cause the system to: receive an indication of a detected vulnerability in a first version of a software application; in response to the indication of the detected vulnerability, generate a tree representation of the first version of the software application; retrieve a plurality of versions of the software application, wherein each of the plurality of version is different than the first version; for each version of the software application of the plurality of versions of the software application, generate a tree representation of the version of the software application; and based on the generated trees, identify at least one version of the plurality of versions of the software application that may include the detected vulnerability.

[0016] In some aspects, the techniques described herein relate to a system, wherein generating the tree representation of the first version of the softwareapplication includes receiving source code of the first version of the software application and generating the tree representation from the source code.

[0017] In some aspects, the techniques described herein relate to a system, further including computer-executable instructions stored thereon that when executed by the at least one computing device cause the system to: receive a proof- of-compromise associated with the detected vulnerability for the first version of the software application; execute a taint analysis using the proof of compromise and the first version of the software application to identify portions of the first version of the software application that are associated with the detected vulnerability; and select a sub-tree of the tree representation of the first version of the application based on the identified portions of the first version of the software application.

[0018] In some aspects, the techniques described herein relate to a system, wherein identifying portions of the first versions of the software application that are associated with the detected vulnerability includes identifying lines of source code associated with the first version of the software application that are associated with the vulnerability.

[0019] In some aspects, the techniques described herein relate to a system, wherein identifying at least one version of the plurality of versions of the software application that may include the detected vulnerability includes: identifying the at least one version of the plurality of versions of the software application that includes a sub-tree that is isomorphic to the selected sub-tree.

[0020] In some aspects, the techniques described herein relate to a system, wherein generating the tree representation of the version of the software application includes generating an abstract signature tree.

[0021] In some aspects, the techniques described herein relate to a system, wherein the abstract signature tree companies a plurality of nodes and a signature for each node, wherein the signature for a node includes signatures of one or more child nodes of the node from among the plurality of nodes.

[0022] In some aspects, the techniques described herein relate to a non- transitory computer-readable medium with computer-executable instructions storedthereon that when executed by at least one computing device cause a system to: receive an indication of a detected vulnerability in a first version of a software application; in response to the indication of the detected vulnerability, generate a tree representation of the first version of the software application; retrieve a plurality of versions of the software application, wherein each of the plurality of version is different than the first version; for each version of the software application of the plurality of versions of the software application, generate a tree representation of the version of the software application; and based on the generated trees, identify at least one version of the plurality of versions of the software application that may include the detected vulnerability.

[0023] In some aspects, the techniques described herein relate to a computer-readable medium, wherein generating the tree representation of the first version of the software application includes receiving source code of the first version of the software application and generating the tree representation from the source code.

[0024] In some aspects, the techniques described herein relate to a computer-readable medium, further including computer-executable instructions stored thereon that when executed by the at least one computing device cause the at least one computing device to: receive a proof-of-com promise associated with the detected vulnerability for the first version of the software application; execute a taint analysis using the proof of compromise and the first version of the software application to identify portions of the first version of the software application that are associated with the detected vulnerability; and select a sub-tree of the tree representation of the first version of the application based on the identified portions of the first version of the software application.

[0025] In some aspects, the techniques described herein relate to a computer-readable medium, wherein identifying portions of the first versions of the software application that are associated with the detected vulnerability includes identifying lines of source code associated with the first version of the software application that are associated with the vulnerability.

[0026] In some aspects, the techniques described herein relate to a computer-readable medium, wherein identifying at least one version of the plurality of versions of the software application that may include the detected vulnerability includes: identifying the at least one version of the plurality of versions of the software application that includes a sub-tree that is isomorphic to the selected subtree.

[0027] In some aspects, the techniques described herein relate to a computer-readable medium, wherein generating the tree representation of the version of the software application includes generating an abstract signature tree.

[0028] Additional advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. The advantages of the invention will be realized and attained by means of the elements and combinations particularly pointed out in the appended claims. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the invention, as claimed.BRIEF DESCRIPTION OF THE DRAWINGS

[0029] The accompanying figures, which are incorporated herein and form part of the specification, illustrate systems and methods for determining vulnerable versions of a software application. Together with the description, the figures further serve to explain the principles of the systems and methods described herein and thereby enable a person skilled in the pertinent art to make and use the systems and methods.

[0030] FIG. 1 is an illustration of an example vulnerability detector for detecting vulnerabilities in versions of a software application;

[0031] FIG. 2 is an illustration of an example method for generating a vulnerability signature for a version of a software application determined to have a vulnerability;

[0032] FIG. 3 is an illustration of an example method for identifying versions of a software application that have a vulnerability; and

[0033] FIG. 4 shows an exemplary computing environment in which example embodiments and aspects may be implemented.DETAILED DESCRIPTION

[0034] FIG. 1 is an illustration of an example vulnerability detector 130 for detecting vulnerabilities 105 in versions of a software application 107. As used herein a vulnerability 105 can include any type of vulnerability that can exist in a software application and can include, but are not limited to buffer overflows, SQL injections, privilege escalation, authentication bypass, and improper error handling. Other vulnerabilities 105 may be detected. Generally, a software application 107 is associated with source code 108 and an executable 109. The source code 108 is typically written in a human readable programming language such as C, C+, Swift, etc. The source code 108 may be compiled to form what is referred to as an executable 109. The executable (or executable code) 109 may be written in assembly or other language that is executable by a general-purpose computing device such as the computing device 500 illustrated with respect to FIG. 4.

[0035] As described above, when a vulnerability 105 is detected in a version of a software application 107, there may be an announcement regarding the vulnerability 105 as well as indications of any other versions of the software application 107 that may also have the same vulnerability 105. However, some versions of the software application 107 may suffer from the same vulnerability 105 even though they are not expressly indicated.

[0036] As a result, individuals or organizations that rely on the software application 107 may need to independently determine if a version of the software application 107 includes the vulnerability. However, doing so is difficult. To distinguish a vulnerable version of a software application 107 from a non-vulnerable one, a deep understanding of the software development process and emergence of vulnerabilities is required. The latest release of an application 107, or where the vulnerabilities 105 are detected, is separated from a particularly older version of the application 107 by hundreds of commits and releases, constituting a large amount ofchanges. As the code evolves from the targeted version to the present version, the vulnerability may emerge or become accessible at some point in the evolution. However, as many projects maintain multiple versions concurrently, identifying one non-vulnerable version does not make all the previous ones non-vulnerable as well.

[0037] Accordingly, to help organizations and others determine versions of software applications 107 that include a vulnerability 105, the vulnerability detector 130 is provided. At a high level, the vulnerability detector 130 may receive an indication of a vulnerability 105 in a version of a software application 107. The vulnerability detector 130 may retrieve other versions of the software application 107 from a repository, database, or other entity that makes software applications 107 available. The vulnerability detector 130 may generate a tree representation 137 of the software application 107 that includes the vulnerability, and tree representations 137 of the other versions of the software application 107. The vulnerability detector 130 may compare the tree representations 137 of the other versions of the application with the tree representation 137 of the version of the software application 107 that includes the vulnerability. Based on the comparisons, the vulnerability detector 130 may determine the other versions of the software application 107 that likely also include the vulnerability. The vulnerability detector 130 is described in further below.

[0038] As shown, the vulnerability detector 130 may include several components, which include, but are not limited to, a tree engine 135, a taint engine 145, and a comparison engine 155. More or fewer components may be supported. The vulnerability detector 130, including the components, may be implemented together or separately using one or more general purpose computing devices such as the computing device 400.

[0039] The tree engine 135 may generate a tree representation 137 from the source code 108 associated with a version of an application 107. The tree representation 137 is an abstract representation of the source code 108 that captures important information about the source code 108 such as language constructs, type abstraction, and other features of the underlying programing language, whileremoving unnecessary information such as formatting and comments. The tree representation 137 is a type of signature that can be used to compare different versions of a software application 107 by comparing trees 137.

[0040] In some embodiments, the tree representation 137 may be an abstract syntax tree (AST). In general, an AST is a tree data structure that represents the structure of the source code 108 and includes a plurality of nodes and edges. Each node may represent a construct included in the source code 108, and each edge may represent a relationship or dependency between the connected constructs. Constructs may include variables, functions, and operators, for example. Any method for generating an AST from source code 108 may be used. In some embodiments, the tree engine 135 may use a program such as clang to generate the tree representation 137. Other methods may be used.

[0041] In some embodiments, each node of the tree representation 137 generated by the tree engine 135 may include a variety of properties including, but not limited to, node kind, type kind, access specifier, and concrete values. Other properties may be included.

[0042] The node kind property encapsulates the language construct abstraction of the syntax tree and may indicate the type of node that the current node is pointing to. Example, node types include Binaryoperator, ImplicitCastExpr and DecIRefExpr.

[0043] The type kind property indicates the type of the node. Examples include type of a variable that the node represents (e.g., int or char), a return type of a function that the node represents, or a target type for a binary operator that the node represents. Generally, the type kind dictates the size of the node which may be associated with certain memory vulnerabilities 105 such as buffer overflow, integer overflow, and integer underflow.

[0044] The access specifier property indicates the access specifier associated with the construct represented by the node such as public, protected, or private, for example. A change in a variable declaration that changes the access can lead to unexpected results by uncontrolled change to its value.

[0045] The concrete values property indicates concrete values associated with the node. These may include the names of functions being called. For binary operators and integer literals, these may include the kind of binary operators and integer values, for example.

[0046] The tree engine 135 may encode the properties and other attributes associated with each node. In some embodiments, the tree engine 135 may generate a string comprising the properties and attributes of a node and may encode the generated string using a hashing algorithm such as MD5. Other hashing algorithms may be used. The encoded node may be referred to as the node fingerprint or signature.

[0047] In addition to the attributes and values, in some embodiments, the tree engine 135 may encode information regarding the child nodes of each node into the node fingerprint. As may be appreciated, while hashing the enriched nodes creates a distinction between syntactically different nodes, it does not capture the distinction between syntactically similar nodes. For example, two binary AND operations will have the same node kind, type kind, access specifier, and concrete values(category from last step). Furthermore, for a lot of nodes such as the If statement, most of the attributes do not even apply. Thus, to better capture the distinction between nodes, it may be beneficial to capture the relative positions of the nodes in the source code 108.

[0048] In some embodiments, to capture the relative position of a node in the source code 108, the tree engine 135 may encode some attributes of its child nodes. In particular, the tree engine 135 may add the signature of the children nodes to the signature of the parent node. As may be appreciated, where there are a large number of nodes, each with multiple children, the size of the signatures may begin to grow exponentially. Accordingly, to prevent such growth, the tree engine 135 may limit the depth that is considered for each node (e.g., two, three, or four generations). The depth may be selected by a user or administrator.

[0049] The taint engine 145 may perform a taint analysis on the executablegenerate a sub-tree 147 from the tree representation 137 based on the taint analysis. As will be described further below, the sub-tree 147 may be used by the comparison engine 155 to identify other versions of the application 107 that may also have the vulnerability 105.

[0050] The taint engine 145 may perform the taint analysis using a proof-of- compromise ("POC") 106 associated with the vulnerability 105. The POC 106 may indicate the particular steps that can be taken to recreate the vulnerability 105 in the particular version of the application 107. POCS 106 may include a particular file that can be used as input to the application 107 to show the vulnerability, a network input that can be provided to the application 107 to show the vulnerability 105, or a command line argument that can be provided to the application 107 to show the vulnerability 105. Other types of POCs 106 may be used. In general, the POC 106 may be provided by a same entity that identified the vulnerability 105 in the version of the application 107.

[0051] The taint engine 145 may perform the taint analysis using the POC 106 and the application 107 using a taint or data analysis tool such as TainGrind. Other tools may be used. The result of the taint analysis may be a log of the execution of the application 107 using the POC 106. The taint engine 145 may use the log to determine one or more files that are associated with the vulnerability 105, for example.

[0052] In some embodiments, prior to executing the application 107 the taint engine 145 may insert debugging symbols or codes into the source code 108 of the application 107 associated with the vulnerability 105. The taint engine 145 may then compile the source code 108 with the debugging symbols to generate the executable code 109.

[0053] Given the inserted debugging symbols and the log from the taint analysis, the taint engine 145 may identify the particular lines from the source code 108 that are associated with the vulnerability 105. Because the nodes of the tree representation 137 correspond to constructs from the source code 108, and each construct is associated with at least one line in the source code 108, the taint engine145 may use the identified lines to "slice" the tree representation 137 into one or subtrees 147 that each correspond to the vulnerability 105. Depending on the embodiment, the taint engine 145 may generate the sub-trees 147 by, for each identified line of code in the source code 108, selecting a sub-tree 147 from the tree representation 137 starting with a root node that corresponds to the node of the tree representation 137 associated with the identified line of source code.

[0054] The comparison engine 155 may use the one or more sub-trees 147 generated for the version of the application 107 with the detected vulnerability 105 to identify other versions of the application 107 that may also be associated with the vulnerability 105. The comparison engine 155 may then publish indicators of the other versions of the application 107 as the vulnerable version identifiers 157.

[0055] In some embodiments, after the taint engine 145 generates the one or more sub-trees 147 for the version of the software application 107 with the vulnerability 105, the comparison engine 155 may retrieve other versions of the software application 107 (i.e., versions of the application 107 that are not otherwise indicated to have the vulnerability 105). Depending on the embodiment, the comparison engine 155 may retrieve the versions of the application 107 from a website or other repository of software applications 107. The comparison engine 155 may retrieve each version of the application 107 by retrieving the source code 108 associated with each version of the application 107.

[0056] The comparison engine 155, after retrieving the source code 108 for each version of the application 107, may cause the tree engine 135 to generate a tree representation 137 for each version of the application 107 from the corresponding source code 108. Each tree representation 137 may be an AST and may be generated in the same way as the tree representation 137 generated for the versions of the application 107 with the vulnerability 105.

[0057] The comparison engine 155 may use the generated tree representations 137 and the one or more sub-trees 147 to identify versions of the application 107 that are likely associated with the vulnerability 105. In particular, the comparison engine 155 may determine any tree representation 137 that includes asub-tree 147 that is isomorphic to the one or more sub-trees 147 generated for the application 107 associated with the vulnerability 105. The comparison engine 155 may then determine that the versions of the application 107 that correspond to the determined tree representations 137 are also associated with the vulnerability 105.

[0058] The comparison engine 155 may provide indications of the versions of the application 107 that are likely associated with the vulnerability. The indications may be provided as the vulnerable versions identifiers 157. In some embodiments, the comparison engine 155 may publish the identifiers 157 along with an indication of the associated vulnerability 105.

[0059] FIG. 2 is an illustration of an example method 200 for generating a vulnerability signature for a version of a software application determined to have a vulnerability. The method 200 may be implemented by the vulnerability detector 130.

[0060] At 201, an indication of a detected vulnerability in a first version of an application is received. The indication of the vulnerability 105 may be received by the vulnerability detector 130. The first version of the application 107 may be a current version of the application 107. However, any version of the application 107 may be associated with the detected vulnerability 105. The indication may be received from an entity that detected the vulnerability 105 or may be published on a website or other location where vulnerabilities 105 are shared.

[0061] At 203, a tree representation of the first version of the application is generated. The tree representation 137 of the first version of the application 107 may be generated by the tree engine 135 from source code 108 of the first version of the application 107. The tree representation 137 may be an AST, or other data structure, and may include a plurality of nodes, where each node represents a construct from the source code 108. Each node may be encoded using a hash of one or more attributes or values of the construct associated with the node. In addition, each node may be encoded with the hashes of one or more child nodes (if any).

[0062] At 205, a POC associated with the detected vulnerability is received. The POC 106 may be received by the taint engine 145 of the vulnerability detector130. The POC 106 may indicate how to duplicate the vulnerability 105 detected in the first version of the application 107.

[0063] At 207, a taint analysis is executed using the POC and the first version of the application to identify portions of the first version of the application that are associated with the vulnerability. The taint analysis may be performed by the taint engine 145 using the POC 106 and the first version of the application 107. In some embodiments, the taint engine 145 may first insert one or more debugging codes into the source code 108 associated with the first version of the application 107 and may compile the modified source code 108 to form the executable 109 for the first version of the application 107. The taint engine 145 may then perform the taint analysis on the executable 109 using the POC 106, and may use the debugging codes to determine lines of the source code 108 that are likely associated with the vulnerability. The taint engine 145 may then use the determined lines of source code to identify the nodes of the tree representation of the 137 of the first version of the application 107 that are associated with the vulnerability 105.

[0064] At 209, one or more sub-trees are selected from the tree representation based on the identified portions. The one or more sub-tree 147 may be selected by the taint engine 145 from the tree representation 137. In some embodiments, each sub-tree 147 may have a root node that corresponds to an identified node of the tree representation 137 and some or all of the children nodes of the identified node from the tree representation 137.

[0065] FIG. 3 is an illustration of an example method 300 for identifying versions of a software application that have a vulnerability. The method 300 may be implemented by the vulnerability detector 130.

[0066] At 301, a plurality of versions of a software application is received. The plurality of software applications 107 may be received by the comparison engine 155 of the vulnerability detector 130. The comparison engine 155 may receive the plurality of versions of the software application 107 after learning that another version of the software application 107, referred to as the first version, has avulnerability 105. The plurality of versions of the application may be different versions than the first version of the application 107 determined to have the vulnerability 105.

[0067] At 303, for each version of the software application, a tree representation is generated. The tree representation 137 of each of each version of the application 107 may be generated by the tree engine 135 using the source code 108 associated with each version of the application 107. Each tree representation 137 may be similar to the tree representation 137 generated for the first version of the application 107 associated with the vulnerability 105 by the method 200.

[0068] At 305, a sub-tree representing a vulnerability in a version of the software application is received. The sub-tree 147 may be received by the comparison engine 155. The sub-tree 147 may have been generated by the taint engine 145 during the method 200, for example.

[0069] At 307, any tree representation that includes a sub-tree that is isomorphic to the received sub-tree is identified. The tree representations 137 that include a sub-tree 37 that is isomorphic to the received sub-tree 147 generated from the version of the application 107 with the vulnerability 105 may be determined by the comparison engine 155.

[0070] At 309, indications of versions of the application with isomorphic sub-trees are provided. The indications of the versions of the application 107 with the isomorphic sub-trees 147 may be provided by the comparison engine 155 as the vulnerable version identifiers 157. In some embodiments, the vulnerability detector 130 may publish the vulnerable version identifiers 157 so that users or entities that use the versions of the application 107 that may also be subject to the vulnerability 105 may switch to other versions of the application 107 that are not subject to the vulnerability 105.

[0071] FIG. 4 shows an exemplary computing environment in which example embodiments and aspects may be implemented. The computing device environment is only one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality.

[0072] Numerous other general purpose or special purpose computing devices environments or configurations may be used. Examples of well-known computing devices, environments, and / or configurations that may be suitable for use include, but are not limited to, personal computers, server computers, handheld or laptop devices, multiprocessor systems, microprocessor-based systems, network personal computers (PCs), minicomputers, mainframe computers, embedded systems, distributed computing environments that include any of the above systems or devices, and the like.

[0073] Computer-executable instructions, such as program modules, being executed by a computer may be used. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform particular tasks or implement particular abstract data types. Distributed computing environments may be used where tasks are performed by remote processing devices that are linked through a communications network or other data transmission medium. In a distributed computing environment, program modules and other data may be located in both local and remote computer storage media including memory storage devices.

[0074] With reference to FIG. 4, an exemplary system for implementing aspects described herein includes a computing device, such as computing device 400. In its most basic configuration, computing device 400 typically includes at least one processing unit 402 and memory 404. Depending on the exact configuration and type of computing device, memory 404 may be volatile (such as random access memory (RAM)), non-volatile (such as read-only memory (ROM), flash memory, etc.), or some combination of the two. This most basic configuration is illustrated in FIG. 4 by dashed line 406.

[0075] Computing device 400 may have additional features / functionality. For example, computing device 400 may include additional storage (removable and / or non-removable) including, but not limited to, magnetic or optical disks or tape. Such additional storage is illustrated in FIG. 4 by removable storage 408 and non-removable storage 410.

[0076] Computing device 400 typically includes a variety of computer readable media. Computer readable media can be any available media that can be accessed by the device 400 and includes both volatile and non-volatile media, removable and non-removable media.

[0077] Computer storage media include volatile and non-volatile, and removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Memory 404, removable storage 408, and nonremovable storage 410 are all examples of computer storage media. Computer storage media include, but are not limited to, RAM, ROM, electrically erasable program read-only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by computing device 400. Any such computer storage media may be part of computing device 400.

[0078] Computing device 400 may contain communication connection(s) 412 that allow the device to communicate with other devices. Computing device 400 may also have input device(s) 414 such as a keyboard, mouse, pen, voice input device, touch input device, etc. Output device(s) 416 such as a display, speakers, printer, etc. may also be included. All these devices are well known in the art and need not be discussed at length here.

[0079] It should be understood that the various techniques described herein may be implemented in connection with hardware components or software components or, where appropriate, with a combination of both. Illustrative types of hardware components that can be used include Field-programmable Gate Arrays (FPGAs), Application-specific Integrated Circuits (ASICs), Application-specific Standard Products (ASSPs), System-on-a-chip systems (SOCs), Complex Programmable Logic Devices (CPLDs), etc. The methods and apparatus of the presently disclosed subject matter, or certain aspects or portions thereof, may take the form of program code(i.e., instructions) embodied in tangible media, such as floppy diskettes, CD-ROMs, hard drives, or any other machine-readable storage medium where, when the program code is loaded into and executed by a machine, such as a computer, the machine becomes an apparatus for practicing the presently disclosed subject matter.

[0080] As used herein, the singular form "a," "an," and "the" include plural references unless the context clearly dictates otherwise. As used herein, the terms "can," "may," "optionally," "can optionally," and "may optionally" are used interchangeably and are meant to include cases in which the condition occurs as well as cases in which the condition does not occur.

[0081] Ranges can be expressed herein as from "about" one particular value, and / or to "about" another particular value. When such a range is expressed, another embodiment includes from the one particular value and / or to the other particular value. Similarly, when values are expressed as approximations, by use of the antecedent "about," it will be understood that the particular value forms another embodiment. It will be further understood that the endpoints of each of the ranges are significant both in relation to the other endpoint, and independently of the other endpoint. It is also understood that there are a number of values disclosed herein, and that each value is also herein disclosed as "about" that particular value in addition to the value itself. For example, if the value "10" is disclosed, then "about 10" is also disclosed.

[0082] Although exemplary implementations may refer to utilizing aspects of the presently disclosed subject matter in the context of one or more stand-alone computer systems, the subject matter is not so limited, but rather may be implemented in connection with any computing environment, such as a network or distributed computing environment. Still further, aspects of the presently disclosed subject matter may be implemented in or across a plurality of processing chips or devices, and storage may similarly be effected across a plurality of devices. Such devices might include personal computers, network servers, and handheld devices, for example.

[0083] Although the subject matter has been described in language specific to structural features and / or methodological acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

Claims

WHAT IS CLAIMED IS:

1. A method of determining versions of a software application that are affected by a vulnerability comprising: receiving an indication of a detected vulnerability in a first version of a software application by a computing device; in response to the indication of the detected vulnerability, generating a tree representation of the first version of the software application by the computing device; retrieving a plurality of versions of the software application by the computing device, wherein each of the plurality of version is different than the first version; for each version of the software application of the plurality of versions of the software application, generating a tree representation of the version of the software application by the computing device; and based on the generated trees, identifying at least one version of the plurality of versions of the software application that may include the detected vulnerability by the computing device.

2. The method of claim 1, wherein generating the tree representation of the first version of the software application comprises receiving source code of the first version of the software application and generating the tree representation from the source code.

3. The method of claim 1, further comprising: receiving a proof-of-com promise associated with the detected vulnerability for the first version of the software application; executing a taint analysis using the proof of compromise and the first version of the software application to identify portions of the first version of the software application that are associated with the detected vulnerability; andselecting a sub-tree of the tree representation of the first version of the application based on the identified portions of the first version of the software application.

4. The method of claim 3, wherein identifying portions of the first versions of the software application that are associated with the detected vulnerability comprises identifying lines of source code associated with the first version of the software application that are associated with the vulnerability.

5. The method of claim 3, wherein identifying at least one version of the plurality of versions of the software application that may include the detected vulnerability by the computing device comprises: identifying the at least one version of the plurality of versions of the software application that includes a sub-tree that is isomorphic to the selected sub-tree.

6. The method of claim 1, wherein generating the tree representation of the version of the software application comprises generating an abstract signature tree.

7. The method of claim 6, wherein the abstract signature tree companies a plurality of nodes and a signature for each node, wherein the signature for a node includes signatures of one or more child nodes of the node from among the plurality of nodes.

8. A system for determining versions of a software application that are affected by a vulnerability comprising: at least one computing device; and a computer-readable medium with computer-executable instructions stored thereon that when executed by the at least one computing device cause the system to:-,n-receive an indication of a detected vulnerability in a first version of a software application; in response to the indication of the detected vulnerability, generate a tree representation of the first version of the software application; retrieve a plurality of versions of the software application, wherein each of the plurality of version is different than the first version; for each version of the software application of the plurality of versions of the software application, generate a tree representation of the version of the software application; and based on the generated trees, identify at least one version of the plurality of versions of the software application that may include the detected vulnerability.

9. The system of claim 8, wherein generating the tree representation of the first version of the software application comprises receiving source code of the first version of the software application and generating the tree representation from the source code.

10. The system of claim 8, further comprising computer-executable instructions stored thereon that when executed by the at least one computing device cause the system to: receive a proof-of-com promise associated with the detected vulnerability for the first version of the software application; execute a taint analysis using the proof of compromise and the first version of the software application to identify portions of the first version of the software application that are associated with the detected vulnerability; and select a sub-tree of the tree representation of the first version of the application based on the identified portions of the first version of the software application.

11. The system of claim 10, wherein identifying portions of the first versions of the software application that are associated with the detected vulnerability comprises identifying lines of source code associated with the first version of the software application that are associated with the vulnerability.

12. The system of claim 10, wherein identifying at least one version of the plurality of versions of the software application that may include the detected vulnerability comprises: identifying the at least one version of the plurality of versions of the software application that includes a sub-tree that is isomorphic to the selected sub-tree.

13. The system of claim 8, wherein generating the tree representation of the version of the software application comprises generating an abstract signature tree.

14. The system of claim 13, wherein the abstract signature tree companies a plurality of nodes and a signature for each node, wherein the signature for a node includes signatures of one or more child nodes of the node from among the plurality of nodes.

15. A non-transitory computer-readable medium with computer-executable instructions stored thereon that when executed by at least one computing device cause a system to: receive an indication of a detected vulnerability in a first version of a software application; in response to the indication of the detected vulnerability, generate a tree representation of the first version of the software application; retrieve a plurality of versions of the software application, wherein each of the plurality of version is different than the first version;for each version of the software application of the plurality of versions of the software application, generate a tree representation of the version of the software application; and based on the generated trees, identify at least one version of the plurality of versions of the software application that may include the detected vulnerability.

16. The computer-readable medium of claim 15, wherein generating the tree representation of the first version of the software application comprises receiving source code of the first version of the software application and generating the tree representation from the source code.

17. The computer-readable medium of claim 15, further comprising computerexecutable instructions stored thereon that when executed by the at least one computing device cause the at least one computing device to: receive a proof-of-com promise associated with the detected vulnerability for the first version of the software application; execute a taint analysis using the proof of compromise and the first version of the software application to identify portions of the first version of the software application that are associated with the detected vulnerability; and select a sub-tree of the tree representation of the first version of the application based on the identified portions of the first version of the software application.

18. The computer-readable medium of claim 17, wherein identifying portions of the first versions of the software application that are associated with the detected vulnerability comprises identifying lines of source code associated with the first version of the software application that are associated with the vulnerability.

19. The computer-readable medium of claim 17, wherein identifying at least one version of the plurality of versions of the software application that may include the detected vulnerability comprises: identifying the at least one version of the plurality of versions of the software application that includes a sub-tree that is isomorphic to the selected sub-tree.

20. The computer-readable medium of claim 15, wherein generating the tree representation of the version of the software application comprises generating an abstract signature tree.

Images