Automated Vulnerable Component Identification Through Patch Comparison
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The existing process for identifying vulnerable software components is manual, time-consuming, and lacks efficiency, particularly in handling vulnerabilities across multiple programming languages and versions, with a need for automation and improved quality of information.
Innovation Solution
A computer-implemented method for identifying vulnerable software components through source-code or byte-code parsing and text analysis, which automates the process by unpacking software packages, retrieving vulnerability database entries, and determining patch changes to identify vulnerable versions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual identification of vulnerable software components is performed, then developers can identify the root cause of vulnerabilities, but the process is time-consuming and involves many manual steps
Solution Approach 1:
The system automatically performs vulnerability identification by comparing source code against vulnerability patterns and CVE databases, enabling the software package itself to be analyzed without requiring manual developer intervention for each vulnerability assessment
Solution Approach 2:
Manual code review and vulnerability analysis by developers is replaced with automated text analysis and pattern matching algorithms that scan source code files, compare against known vulnerability patterns, and identify vulnerable components automatically
2Measurement precision
If security feeds are compiled for widely used programming languages only, then quality information is provided for those languages, but additional languages such as Go, C#, .NET, Rust, PHP are not covered
Solution Approach 1:
The vulnerability identification system is designed to handle multiple programming languages and software package formats through a unified text analysis approach that can process source code files regardless of the specific programming language, making the system universally applicable across different language ecosystems
3Device complexity
If a single data-source is used for vulnerability identification, then the process is simplified, but function names in CVEs might be misspelled or wrong and commits may contain unrelated changes
Solution Approach 1:
The system cross-validates vulnerability findings by comparing multiple independent sources including CVE databases, security feeds, and source code repository information, using feedback loops to verify identified vulnerabilities and filter out false positives through multi-source correlation
Solution Approach 2:
The text analysis system acts as an intermediary that processes and correlates information from multiple independent sources (CVE databases, security feeds, source code repositories), reconciling discrepancies and synthesizing accurate vulnerability identification results from conflicting or incomplete source data
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
An automated identification of vulnerable software components is presented. The objective to find a method for the automatic identification of CVE affected software components through source-code parsing and text analysis. The method shall reduce manual work to a minimum and ensure a high level of data quality. The objective is solved by the computer-implemented method for identifying vulnerable software, comprising: receiving a software package; unpacking source code files for multiple versions of the software package; retrieving an entry for the software package from a vulnerability database; retrieving a patch for the software package; determining changes made by the patch to source code files of the software package; and determining whether the changes were made to a given version of software and reporting the given version of software as vulnerable in response to a determination the changes were absent from the given version of software.