Code Topology Analysis for Fault Injection Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods for identifying vulnerabilities to fault injection attacks in computer code are time-consuming and prone to errors, often leading to undetected vulnerabilities that can be exploited to access sensitive data.
Innovation Solution
A code analyzer that uses machine learning to generate a model based on training vectors characterizing vulnerable programming patterns, analyzes code topology to identify potential vulnerabilities, and emulates fault injections to confirm and train the model for improved detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If visual inspection of source code is used to identify vulnerabilities, then human expertise can be applied to detect security issues, but the process takes an exceedingly lengthy period of time and is error-prone
Solution Approach 1:
The patent replaces the mechanical system of human visual inspection with an automated computer-based analysis system that uses machine learning models and code topology generation to detect vulnerabilities, thereby eliminating time loss while maintaining or improving detection accuracy
Solution Approach 2:
The system enables code to analyze itself by generating topologies from the code structure and applying machine learning models automatically, allowing the code base to self-diagnose vulnerabilities without requiring manual human inspection
2Reliability
If visual inspection of entire code base is performed, then comprehensive vulnerability identification is possible, but it requires an exceedingly lengthy period of time
Solution Approach 1:
The patent segments the code base into manageable topological representations (control flow graphs, data flow graphs) that can be automatically analyzed by machine learning models, enabling comprehensive vulnerability identification across the entire code base without the time penalty of manual inspection
Solution Approach 2:
The system transforms code from its traditional textual form into topological parameters and features that capture structural relationships, allowing automated analysis to efficiently evaluate vulnerability characteristics across the entire code base
3Measurement precision
If manual code inspection is used, then test engineers can identify vulnerabilities, but they may overlook vulnerabilities or fail to identify unknown vulnerabilities
Solution Approach 1:
The patent introduces code topology as an intermediary representation between the raw code and the machine learning model, enabling automated detection of both known and unknown vulnerability patterns without requiring complex manual analysis procedures
Data Source
AI summary
A code analyzer implements machine learning to detect vulnerabilities in computer code. The code analyzer trains a machine learning model using training vectors that characterize vulnerable programming patterns. The code analyzer evaluates a topological representation of the computer code using the machine learning model to identify a potential vulnerability. The potential vulnerability corresponds to a portion of the computer code where an attack can be used to bypass a security procedure. The code analyzer tests the potential vulnerability by emulating a fault injection during execution of the portion of the computer code. Upon confirming that the potential vulnerability can be exploited via a fault injection, the code analyzer generates a training vector that characterizes a vulnerable programming pattern associated with the portion of the computer code. The training vector can be used to further train the machine learning model.