Automated Patch Generation for Software Security Violations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software security systems lack automation for mitigating security violations, leading to prolonged vulnerability periods as manual efforts by operators take significant time to fix issues, leaving applications at risk for months.
Innovation Solution
An automated method and system for generating patches that identify security violations, determine patch conditions and locations, and insert candidate patches to prevent security violations, reducing the time to mitigate exploitation from months to hours.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual operators are used to fix security violations, then the fixing process can be thoroughly reviewed and approved, but the time required to fix security violations increases significantly (months)
Solution Approach 1:
The system performs preliminary actions by automatically generating candidate patches and executing them before human operators complete the full fix process. The patch generation system creates patches in advance, executes them to verify effectiveness, and prepares them for deployment, thereby reducing the time operators need to spend on the critical path while maintaining reliability through subsequent human review.
Solution Approach 2:
An automated patch generation system is introduced as an intermediary between the detection of security violations and the manual fixing process. This intermediary automatically generates candidate patches, executes them to verify they resolve the violations, and presents them to operators for review, thereby bridging the time gap while maintaining the reliability benefits of human oversight.
2Loss of time
If automated patch generation is implemented, then the time to mitigate security violations is reduced (from months to hours), but the complexity of the system increases
Solution Approach 1:
The system enables self-service by allowing the automated patch generation system to independently generate candidate patches, execute them to verify effectiveness, and prepare them for deployment without requiring constant human intervention. The system serves itself by automatically managing the patch creation and validation process, reducing the need for complex human-in-the-loop workflows while maintaining reliability through optional review.
3Reliability
If candidate patches are executed to verify effectiveness, then the reliability of security violation mitigation is improved, but the computational resources and time required for testing increase
Solution Approach 1:
The system applies partial action by executing candidate patches selectively based on the severity and type of security violation. Not all candidate patches require full execution verification - the system can perform partial testing or prioritize execution based on the criticality of the vulnerability, thereby reducing overall computational resource consumption while maintaining reliability for the most important security fixes.
Data Source
AI summary
Aspects of the disclosure provide for automatically generating patches for security violations. For example, a plurality of inputs may be generated for code. The code may be executed using the plurality of inputs to obtain execution states at a plurality of code locations. The execution states may include at least one security violation for at least some of the plurality of inputs. Using the execution states, one or more patch conditions causing the at least one security violation may be determined. Using the execution states, one or more corresponding patch locations may be determined based on a code location of the plurality of code locations where the at least one security violation each of the one or more patch conditions occurred. At least one candidate patch for the at least one security violation may be automatically generated. The at least one candidate patch may include one of the patch conditions and one of the corresponding patch locations.