Container Vulnerability Scanning via Pruned Call Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software development processes waste resources correcting unreachable vulnerabilities in code, as they are not executed in real scenarios, while overlooking reachable vulnerabilities.
Innovation Solution
A method and apparatus for generating a call and dependency graph of container entities using static analysis, pruning edges based on heuristics, and training to distinguish between reachable and unreachable vulnerabilities, reducing false positives and negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all vulnerabilities are corrected without distinction, then security coverage is improved, but resource waste increases due to correcting unreachable vulnerabilities
Solution Approach 1:
The patent segments vulnerabilities into two categories: reachable and unreachable. It constructs a call graph to identify which vulnerabilities can actually be executed and which cannot. By segmenting the vulnerability set, the system focuses remediation efforts only on reachable vulnerabilities, avoiding waste on unreachable ones while maintaining comprehensive security coverage for actual risks.
2Productivity
If static analysis is used to identify reachable vulnerabilities, then resource efficiency is improved, but measurement precision deteriorates due to false positives and negatives
Solution Approach 1:
The patent introduces a call graph as an intermediary structure between static analysis and vulnerability identification. The call graph models the execution flow and data dependencies, serving as a mediator that filters vulnerabilities based on reachability. This intermediary enables static analysis to achieve better precision by using the call graph to eliminate false positives and negatives, while maintaining resource efficiency through static rather than dynamic analysis.
3Measurement precision
If dynamic execution is used to determine vulnerability reachability, then measurement precision is improved, but productivity decreases due to execution overhead
Solution Approach 1:
The patent replaces the mechanical execution system (dynamic runtime analysis) with a static analysis system based on call graph construction. Instead of actually executing the code to determine reachability, the system builds a static model of the program's control flow and data dependencies. This substitution maintains high measurement precision by accurately modeling execution paths while dramatically improving productivity by avoiding the overhead of dynamic execution.
Data Source
AI summary
A method, computerized apparatus and computer program product, the method comprising: obtaining a collection of entities including a source code file and a non-source-code file; identifying a bundle within the collection of entities; generating a call and dependency graph of the collection of entities, the graph comprising two or more nodes each associated with an entity, and at least one edge indicating a calling relationship between the nodes, said generating comprising: generating an initial call and dependency graph, indicating reachability of each of the collection of entities starting from an entry point; and pruning the initial call and dependency graph by reducing an edge according to collected heuristics, to obtain a pruned call and dependency graph; obtaining information about vulnerabilities associated with the bundle or any of the collection of entities; and providing an indication of a reachable vulnerability and an unreachable vulnerability in the pruned call and dependency graph.