API Scanner Hierarchies for Runtime Security Risk Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing software security measures, such as static code scans and dynamic application testing, fail to provide comprehensive protection against vulnerabilities in software drivers and applications, particularly during continuous integration/continuous deployment (CI/CD) cycles.

Innovation Solution

Implement a compute unified device architecture (CUDA) based system that dynamically creates hierarchical scanners at build time to monitor APIs and calculates an overall risk score, allowing for customizable and adaptable security assessments during runtime, and modifies the software code if necessary to mitigate risks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If static code scans and dynamic application testing are used, then some security protection is provided, but comprehensive protection against vulnerabilities is not achieved

Engineering Contradiction:

Improvesecurity protectionVSAvoidcomprehensive protection coverage

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The patent implements dynamic scanners that are created at build time and execute at runtime to monitor API usage. These scanners adaptively track actual API calls made by the software during execution, allowing the security system to evolve from static analysis to dynamic, runtime-based vulnerability detection that comprehensively covers actual usage patterns.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system performs preliminary scanning at build time to identify all APIs used by the software before deployment. This advance identification enables the creation of customized scanners tailored to the specific API footprint of each application, ensuring comprehensive coverage without requiring exhaustive runtime analysis of all possible APIs.

Inventive Principle:

Principle #10Preliminary action

2Reliability

If comprehensive API monitoring is implemented, then security coverage is improved, but system complexity increases

Engineering Contradiction:

Improvesecurity coverageVSAvoidscanner system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent divides the security monitoring system into multiple specialized scanners, each responsible for monitoring specific APIs or API categories. This segmentation allows the complex task of comprehensive API monitoring to be broken down into manageable, independent scanner modules that can be created and executed efficiently without overwhelming system complexity.

Inventive Principle:

Principle #1Segmentation

3Reliability

If risk scores are calculated and used to modify software, then security is enhanced, but build time and processing time increase

Engineering Contradiction:

Improvesecurity enhancementVSAvoidbuild time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system calculates risk scores based on multiple parameters including API vulnerability data, usage frequency, and security implications. By optimizing the calculation methodology and using the scores strategically to determine modifications only when necessary, the system enhances security without requiring excessive build time for every software update.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS20250321729A1Security risk detection

Publication Date: 2025.10.16 NVIDIA CORP

AI summary

Apparatuses, systems, and techniques to detect potential security risks using application program interface (API) scanners. In at least one embodiment, software is scanned to identify one or more APIs of different categories and the position of the APIs and associated code in an executable file may be altered to reduce one or more potential risks.