Relational Abstraction for Container Data-Flow Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional security analysis systems face difficulties in accurately tracking data-flows through complex containers in large-scale application programs, leading to false positives in security vulnerability detection due to the complexity of container operations.
Innovation Solution
The method involves detecting containers within program code, selecting a model container correlated with the actual container, creating an instance of the model container in memory, and tracking data-flows through the model container instead of the actual container, using representative operations that manipulate data as tuples to simplify the analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If data-flow tracking is performed through actual containers in large-scale applications, then security vulnerability detection is attempted, but the complexity of container operations causes inaccurate tracking and false positives
Solution Approach 1:
The patent creates model containers that are simplified copies of actual containers. These model containers replicate the essential data-flow behavior of complex containers while using straightforward data structures that enable accurate tracking. The model container serves as a tractable representation that preserves security-relevant data-flow characteristics without the operational complexity of the original container.
Solution Approach 2:
The model container acts as an intermediary between the actual container and the security analysis system. Instead of directly analyzing the complex actual container, the system analyzes the simplified model container, which mediates the data-flow information in a form that is easy to track and analyze while still representing the security-critical behavior.
2Reliability
If conventional security analysis is applied to large-scale applications, then security testing is performed, but the large scale of the application makes data-flow tracking difficult and generates false positives
Solution Approach 1:
The patent segments the complex application analysis into two distinct parts: the actual container execution and the model container analysis. By separating the concrete container operations from the analytical process, the system can maintain reliability in security detection while avoiding the complexity of directly analyzing large-scale application data-flows through complex containers.
Solution Approach 2:
The model container serves as a simplified copy that enables reliable security analysis without being constrained by the scale and complexity of the actual application. This copy allows the security system to perform accurate data-flow tracking that would be infeasible on the full-scale application directly.
Data Source
AI summary
Analyzing program code can include detecting an instance of a container within the program code using a processor, selecting a model container correlated with the container using the processor, and creating an instance of the model container within memory using the processor. A data-flow of the program code can be tracked through the instance of the model container instead of the instance of the container.