Program Vulnerability Detection Using CVE File and Function Matching

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing vulnerability detection methods using the Common Vulnerabilities and Exposures (CVE) system are limited in specifying the file and function corresponding to vulnerabilities in open-source software, leading to inefficient and resource-intensive vulnerability identification.

Innovation Solution

A method for detecting vulnerabilities in a program by extracting vulnerability file and function names from a description of pre-stored vulnerabilities, and determining target files and functions using tokenization and part-of-speech identification, enabling precise identification of vulnerable components within a program.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of information

If CVE system is used to find vulnerabilities, then vulnerability information can be obtained, but specific file and function corresponding to vulnerability cannot be specified

Engineering Contradiction:

Improvevulnerability information completenessVSAvoidvulnerability location precision

Core Design Contradiction:

Loss of informationVSMeasurement precision

Solution Approach 1:

The patent segments the vulnerability detection process into multiple stages: first extracting vulnerability information from CVE descriptions, then identifying candidate files and functions through tokenization, and finally determining the specific vulnerable file and function. This segmentation transforms the incomplete CVE information into precise location identification by breaking down the detection task into manageable steps that progressively refine the vulnerability location.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary mechanism using tokenization and part-of-speech identification as a bridge between CVE vulnerability descriptions and source code files. This intermediary process extracts keywords from CVE descriptions, matches them with code elements, and identifies the specific vulnerable file and function, thereby connecting the general vulnerability information to precise location data.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Loss of information

If CVE system is used to passively find vulnerabilities, then vulnerability information can be secured, but many resources are consumed in the process

Engineering Contradiction:

Improvevulnerability information acquisitionVSAvoidresource consumption

Core Design Contradiction:

Loss of informationVSLoss of energy

Solution Approach 1:

The patent extracts only the essential and relevant information from CVE descriptions through tokenization and part-of-speech identification, rather than processing entire vulnerability databases or performing exhaustive code analysis. By extracting only the necessary keywords and matching them with source code elements, the system achieves efficient vulnerability detection with minimal resource consumption.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies partial action by focusing only on the specific files and functions that are likely to contain vulnerabilities, rather than analyzing the entire codebase. By identifying candidate files and functions based on CVE description keywords and performing targeted analysis only on these candidates, the system reduces resource consumption while maintaining detection effectiveness.

Inventive Principle:

Principle #16Partial or excessive action

3Measurement precision

If manual searches are performed to identify vulnerable files and functions, then precise vulnerability location can be found, but extensive manual work is required

Engineering Contradiction:

Improvevulnerability location precisionVSAvoidmanual search time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent implements self-service by enabling the system to automatically extract vulnerability information from CVE descriptions, identify candidate files and functions through tokenization, and determine the specific vulnerable location without human intervention. The automated processing of CVE descriptions and matching with source code elements replaces manual searches, achieving both precision and efficiency.

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent replaces the mechanical manual search process with an automated computational system that uses tokenization, part-of-speech identification, and pattern matching algorithms. This substitution transforms the manual, time-consuming vulnerability location identification into an automated process that rapidly analyzes CVE descriptions and source code to precisely locate vulnerabilities.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS20260017385A1Method For Detecting Vulnerabilities In A Program

Publication Date: 2026.01.15 LABRADOR LABS INC

AI summary

According to an embodiment of the present disclosure, a method for detecting vulnerability in program containing a plurality of source code files, performed by a computing device is disclosed. The method may comprises: extracting at least one of a vulnerability file name corresponding to a pre-stored vulnerability file or a vulnerability function name corresponding to a pre-stored vulnerability function, from a description of pre-stored vulnerabilities; extracting at least one candidate source code file from among the plurality of source code files in the program, the candidate source code file being subject to determination of whether it contains a vulnerability; and determining at least one of a target file or a target function having a vulnerability within the program, by using the candidate source code file and at least one of the vulnerability file name or the vulnerability function name.