Combined Call Graphs for Vulnerability Impact Assessment

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Assessing the impact of third-party library vulnerabilities on software applications is complicated by short and incomprehensible vulnerability descriptions and transitive dependencies, leading to inaccurate impact assessments and unnecessary patch development or exposure to attacks.

Innovation Solution

The use of combined call graphs, generated through static and dynamic source code analysis, to provide detailed, code-level information on vulnerable functions, reducing false-positives and false-negatives by accurately assessing vulnerability relevance and criticality, and facilitating mitigation measures.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If experts manually analyze every third-party library vulnerability in detail, then the accuracy of vulnerability impact assessment improves, but the time and effort required increases significantly

Engineering Contradiction:

Improvevulnerability impact assessment accuracyVSAvoidtime for vulnerability analysis

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent segments the vulnerability analysis process into automated static analysis components and manual expert review components. The system automatically generates call graphs, identifies vulnerable functions, and filters out obviously safe vulnerabilities, leaving only critical cases for expert analysis. This segmentation reduces the overall time while maintaining accuracy for the most important cases.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary automated analysis system that acts as a mediator between the vulnerability database and expert analysts. This intermediary processes vulnerability reports, generates call graphs, and prioritizes cases, reducing the direct burden on experts while preserving their judgment capabilities for critical assessments.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If comprehensive static source code analysis is performed on the entire application and all third-party libraries, then the completeness of vulnerability detection improves, but the complexity of processing and analyzing the results worsens

Engineering Contradiction:

Improvevulnerability detection completenessVSAvoidanalysis result processing complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent extracts and focuses analysis on specific vulnerable functions identified in third-party libraries rather than analyzing the entire codebase uniformly. By taking out only the relevant vulnerable portions and their call contexts, the system maintains detection completeness while reducing processing complexity to manageable levels.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies different analysis depths and methods to different parts of the codebase. Critical vulnerable functions receive detailed localized analysis with full call graph generation, while other areas receive lighter analysis. This local quality approach ensures thoroughness where needed while reducing overall complexity.

Inventive Principle:

Principle #3Local quality

3Measurement precision

If detailed call graphs are generated for all vulnerable functions, then the accuracy of impact assessment improves, but the time required to generate and process graphs worsens

Engineering Contradiction:

Improveimpact assessment accuracyVSAvoidvulnerability assessment throughput

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The patent generates full detailed call graphs only for the most critical vulnerable functions, while using lighter analysis methods for less critical cases. This partial action approach maintains high accuracy for the most important vulnerabilities while improving overall throughput by not applying the same level of detail uniformly to all cases.

Inventive Principle:

Principle #16Partial or excessive action

Solution Approach 2:

The patent performs preliminary filtering and triage of vulnerabilities before generating detailed call graphs. By预先 identifying and prioritizing the most critical vulnerable functions, the system can allocate detailed analysis resources efficiently, maintaining accuracy for critical cases while improving overall productivity through staged processing.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS9792200B2Assessing vulnerability impact using call graphs

Publication Date: 2017.10.17 SAP SE

AI summary

Implementations are directed to enhancing assessment of one or more known vulnerabilities inside one or more third-party libraries used within an application program that interacts with the one or more third-party libraries. In some examples, actions include receiving a complete call graph that is provided by static source code analysis (SSCA) of the application program and any third-party libraries used by the application, receiving one or more stack traces that are provided based on dynamic source code analysis (DSCA) during execution of the application program, processing the complete call graph, the one or more stack traces, and vulnerable function data to provide one or more combined call graphs, the vulnerable function data identifying one or more vulnerable functions included in the one or more third-party libraries, each combined call graph being specific to a respective vulnerable function, and providing a graphical representation of each combined call graph.