Code Similarity Analysis for SAST Vulnerability Auditing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static Application Security Testing (SAST) tools often generate numerous false positives, leading to resource-intensive efforts in reviewing and addressing potential security vulnerabilities, which increases costs and requires skilled expertise, as they over-approximate potential insecurities in program code.
Innovation Solution
The integration of code similarity analysis with SAST, where flagged code is grouped and ranked based on similarity scores, allowing for the presentation of similar issues that have already been analyzed or repaired, reducing the need for manual review and expertise by leveraging existing fixes from similar code clones.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SAST tools are used to analyze source code for security vulnerabilities, then security issues can be detected, but numerous false positives are generated requiring resource-intensive manual review
Solution Approach 1:
The patent segments the large set of SAST findings into groups based on code similarity metrics. By dividing the review workload into similarity-based clusters, reviewers can efficiently handle groups of related findings rather than examining each finding individually, reducing overall review resources while maintaining detection accuracy.
Solution Approach 2:
The patent creates similarity copies (code clones) of vulnerable code patterns and uses them to generate repair recommendations. By copying and adapting fixes from similar code patterns, the system reduces manual review effort while maintaining reliable vulnerability detection through automated similarity-based matching.
2Measurement precision
If manual review of SAST results is performed to reduce false positives, then review accuracy improves, but significant human resources and expertise are required
Solution Approach 1:
The patent implements self-service by enabling the system to automatically generate repair recommendations based on code similarity analysis. This reduces the need for human expertise in reviewing each finding, as the system autonomously identifies patterns and suggests fixes, thereby reducing human resource requirements while maintaining review accuracy.
Solution Approach 2:
The patent incorporates feedback loops where SAST findings are analyzed, similarity metrics are computed, and repair recommendations are generated. This automated feedback mechanism reduces the need for manual intervention by continuously learning from code patterns and improving recommendation accuracy, thereby reducing human resource requirements.
3Extent of automation
If code similarity analysis is integrated with SAST, then repair recommendations can be automated, but system complexity increases
Solution Approach 1:
The patent implements a unified code analysis system that performs both SAST and code similarity analysis through a single integrated platform. This multi-functional approach automates repair recommendations while managing system complexity by consolidating multiple analysis functions into one cohesive system rather than separate independent tools.
Data Source
AI summary
Implementations of the present disclosure include methods, systems, and computer-readable storage mediums for receiving results from security testing of source code, each result indicating a potential security vulnerability of the source code, displaying graphical representations of the results to a user, and, by a fix recommendation generator: receiving user input indicating a result of the results, receiving a set of code clones, each code clone being provided based on at least a snippet of the source code underlying the result, receiving a set of repairs, each repair being associated with a code clone, and mitigating a previously determined security vulnerability, and providing a set of fix recommendations based on the set of code clones, the set of repairs, and similarity metrics, each similarity metric indicating a similarity between the at least a snippet of the source code and a respective code clone.