Source Code Security Flaw Detection via History-Based Policy Inference
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security systems for source code analysis lack a code history-based approach, requiring manual security policy writing and failing to account for the actual characteristics of bugs, leading to increased development costs and potential security vulnerabilities.
Innovation Solution
A system that analyzes code history by obtaining and modifying information flow policies based on changes in source code revisions, using a dependency graph with security labels and declassification points to detect and report security flaws.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual security policy writing is used, then security analysis can be performed, but development cost increases significantly
Solution Approach 1:
The system automatically infers information flow policies by analyzing code history and repository data, enabling the security analysis system to self-generate policies without manual intervention. This automation directly resolves the contradiction by eliminating the labor-intensive manual policy writing process while maintaining comprehensive security analysis capabilities.
Solution Approach 2:
The system performs preliminary analysis of code history and repository data to pre-infer information flow policies before actual security analysis is needed. By preparing policies in advance through automated analysis of historical code patterns and repository metadata, the system eliminates the need for manual policy creation while ensuring security policies are ready for immediate use.
2Productivity
If code history analysis is not incorporated, then existing security approaches can be implemented, but they fail to account for actual bug characteristics
Solution Approach 1:
The system performs preliminary analysis of code history to establish baseline information flow patterns and bug characteristics before conducting security analysis. By examining historical code revisions, commit messages, and repository metadata in advance, the system builds contextual understanding that enables more accurate detection of actual bug characteristics during security analysis.
Solution Approach 2:
The system continuously feeds back information from code history analysis and repository data into the security analysis process. By incorporating historical bug patterns, code evolution trends, and repository metadata feedback, the system progressively improves its ability to account for actual bug characteristics, resolving the precision deficiency of existing approaches.
3Reliability
If static analysis is made standard in systems development, then security foundation is improved, but tools must be manually tailored to each product line
Solution Approach 1:
The system creates a universal security analysis tool that automatically adapts to different product lines by analyzing their specific code history and repository characteristics. By implementing multi-functionality that handles diverse programming languages, repository structures, and code bases through a single automated system, the tool eliminates the need for manual tailoring while maintaining strong security foundations across all product lines.
Solution Approach 2:
The system performs preliminary analysis of each product line's code history and repository data to automatically generate product-specific security configurations. By preparing tailored security policies in advance through automated analysis rather than manual configuration, the system maintains the security foundation benefits of standardized static analysis while eliminating the complexity of manual tool tailoring for each product line.
Data Source
AI summary
The present invention relates to a system for detecting source code security flaws through analysis of code history. First, the system obtains a previously inferred information flow policy, the previously inferred informational flow policy being based on a previous source code revision. The system then determines changes in source code between a previous source code revision and a current source code revision. Finally, a current inferred information flow policy is generated by modifying the previously inferred information flow policy to reflect the changes in source code. If the changes in the source code do not comply with the previously inferred information flow policy, then the changes are reported to a developer.