Abstract Program Representations for Secure Static Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current static analysis tools face challenges in being easily integrated into application development lifecycles due to installation, configuration, and licensing issues, and there is a lack of cross-team collaboration and feedback, leading to sub-optimal security vulnerability remediation and duplication of work.
Innovation Solution
An application analysis platform generates abstract program representations (APRs) that are encapsulated into binary archive files (ARSA) for secure, efficient static data-flow analysis, allowing for obfuscation of source code and merging of components for comprehensive analysis across different teams and environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional software packages are used for static analysis tools, then the tool functionality is complete, but the installation, configuration, and maintenance complexity increases
Solution Approach 1:
The patent creates a simplified copy of the static analysis tool in the form of a browser extension. Instead of requiring installation of a complete software package, the tool is replicated as a lightweight extension that can be added to an existing web browser, eliminating complex installation and configuration steps while maintaining core analysis functionality.
Solution Approach 2:
The patent introduces a browser extension as an intermediary layer between the user and the static analysis tool. This intermediary packages the tool's functionality within the browser ecosystem, allowing users to access and utilize the analysis capabilities without directly managing the underlying software complexity.
2Adaptability or versatility
If source code is shared for collaboration, then cross-team feedback improves, but security vulnerabilities can be exploited by malicious users
Solution Approach 1:
The patent creates an obfuscated copy of the source code representation that preserves the structural and logical information needed for analysis and collaboration while removing or obfuscating sensitive security-critical details. This allows teams to collaborate on code review and feedback without exposing the original source code to potential exploitation.
Solution Approach 2:
The patent extracts only the necessary information from the source code for analysis purposes, separating the code structure and logic from the sensitive security implementations. This extraction allows collaborative review of non-sensitive portions while protecting security-critical sections from exposure to malicious users.
3Measurement precision
If complete source code is scanned for security analysis, then analysis accuracy is high, but processing time and resource consumption increase
Solution Approach 1:
The patent extracts and analyzes only the critical structural and logical elements of the source code rather than processing every line and detail. This selective extraction maintains sufficient accuracy for security vulnerability detection while significantly reducing processing time and computational resource consumption.
Solution Approach 2:
The patent segments the source code analysis into distinct phases and components, analyzing different portions of the code at different levels of detail. Critical security-relevant sections receive thorough analysis while less critical areas are processed more lightly, optimizing the balance between accuracy and processing speed.
Data Source
AI summary
An application analysis platform enables automatic generation of abstract program representations (APRs) that are amenable to static analyses for finding security vulnerabilities. The APR is generated automatically, preferably from an existing build system or a source repository, and then encapsulated into a binary archival format for consumption by a static analysis tool, which operates on-premises or in the cloud. The abstract program representation is a highly compact version of the actual source code it represents. The archival format obfuscates the source code that is subjected to the analysis, thus protecting it from being reverse-engineered when moved off-premises or otherwise shared with other users, teams and even organizations. Binary archive files generated separately from different source code components may be readily merged and analyzed together to provide more effective static data-flow analysis, even with respect to components that are built on different machines by different teams and at different times.