Source Code Sequence Mining for Vulnerability Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing software vulnerability detection tools require prior knowledge of problematic patterns and cannot automatically identify security breaches in software code without user-defined criteria, limiting their effectiveness in finding potentially hazardous sequences.

Innovation Solution

Applying sequence mining techniques to normalize software code into a sequence of tags, allowing for the identification of statistically similar sub-sequences and deviations from common patterns, which may indicate vulnerabilities such as missing operations, permission failures, or errors in business logic, without requiring predefined patterns.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If prior knowledge of problematic patterns is required for vulnerability detection, then detection accuracy is improved, but adaptability to new vulnerability types deteriorates

Engineering Contradiction:
Improvedetection accuracyVSAvoidadaptability to new vulnerability types
Core Design Contradiction:
Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The system performs self-learning by automatically analyzing code sequences and identifying vulnerability patterns without requiring pre-programmed knowledge. The miner component learns from the codebase itself, enabling the system to adapt to new vulnerability types while maintaining detection accuracy through autonomous pattern recognition

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The system transforms code into sequential representations with adjustable parameters such as sequence length, similarity thresholds, and statistical significance levels. These parameter changes enable flexible detection of diverse vulnerability patterns while maintaining precision through configurable analysis depth

Inventive Principle:
Principle #35Parameter changes

2Measurement precision

If user-defined criteria are used for pattern matching, then detection precision is improved, but ease of operation deteriorates

Engineering Contradiction:
Improvedetection precisionVSAvoidease of use
Core Design Contradiction:
Measurement precisionVSEase of operation

Solution Approach 1:

The miner automatically generates detection criteria by analyzing code sequences and identifying statistical patterns. Users simply initiate the analysis and receive vulnerability reports without needing to define complex search patterns or criteria, maintaining high precision through autonomous learning

Inventive Principle:
Principle #25Self-service

Solution Approach 2:

The sequential representation and statistical analysis components act as intermediaries between the codebase and vulnerability detection. These intermediaries automatically process raw code into analyzable patterns, eliminating the need for users to directly define complex matching criteria while preserving detection precision

Inventive Principle:
Principle #24Intermediary (Mediator)

3Reliability

If comprehensive code analysis is performed to detect all vulnerability types, then detection coverage is improved, but processing time increases

Engineering Contradiction:
Improvedetection coverageVSAvoidprocessing time
Core Design Contradiction:
ReliabilityVSLoss of time

Solution Approach 1:

The codebase is divided into sequential segments (functions, blocks, statements) that are analyzed independently and then recombined. This segmentation enables comprehensive coverage of vulnerability patterns while reducing processing time through parallel analysis of discrete code units

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The system performs statistical analysis on code sequences with configurable depth, analyzing only the most relevant portions of code based on learned patterns. This partial action approach maintains high detection coverage by focusing computational resources on high-risk areas identified through statistical significance

Inventive Principle:
Principle #16Partial or excessive action

Data Source

PatentEP2609506B1Mining source code for violations of programming rules
Publication Date: 2019.01.16 CHECKMARX LTD
  • EP2609506B1 patent drawingFigure 1~2
  • EP2609506B1 patent drawingFigure 3~4
  • EP2609506B1 patent drawingFigure 5

AI summary

A method for software code analysis includes automatically processing a body of software source code (23) by a computer (22) in order to identify a group of sequences of instructions that are characterized by a common pattern. A sequence within the group containing a deviation from a norm of the common pattern is found and reported as a potential vulnerability in the software source code.