Data Flow Graph Analysis for Exploitable Vulnerability Detection

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing software analysis tools fail to effectively distinguish between exploitable and non-exploitable vulnerabilities in library programs used by application programs, leading to false positive results and inefficient resource allocation for security threats.

Innovation Solution

A method and apparatus that generate and combine data flow graphs (DFGs) for both application and library programs to track data flows, identifying vulnerabilities and determining their exploitable status by linking application entry points to library vulnerabilities, using a database of known vulnerabilities and API invocations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If existing software analysis tools are used to detect vulnerabilities in library programs, then vulnerabilities can be identified, but false positive results increase and resource allocation efficiency decreases

Engineering Contradiction:
Improvevulnerability detection accuracyVSAvoidresource allocation efficiency
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The patent segments the data flow analysis into two distinct graphs: an application-level DFG showing data flow from application inputs to library function calls, and a library-level DFG showing data flow from library function calls to vulnerable parameters. This segmentation allows precise tracking of which application inputs actually reach which library vulnerabilities, eliminating false positives while maintaining comprehensive coverage.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary mechanism that combines the application DFG and library DFG through library function call nodes. This intermediary structure acts as a bridge that correlates application inputs with library vulnerabilities through the actual data flow paths, enabling accurate determination of exploitability without requiring direct analysis of all possible paths.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Measurement precision

If comprehensive data flow analysis is performed to track all data flows from application inputs to library vulnerabilities, then exploitable vulnerabilities can be accurately identified, but analysis complexity increases

Engineering Contradiction:
Improveexploitability determination accuracyVSAvoidanalysis system complexity
Core Design Contradiction:
Measurement precisionVSDevice complexity

Solution Approach 1:

The patent divides the complex analysis system into two separate but complementary data flow graphs: an application-level DFG that captures data flow from application inputs to library function calls, and a library-level DFG that captures data flow from library function calls to vulnerable parameters. This segmentation reduces the complexity of analyzing the entire system at once while maintaining the ability to trace complete data flow paths when needed.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent merges the application DFG and library DFG by combining them at the library function call nodes, creating a unified view that enables complete data flow tracing from application inputs to library vulnerabilities. This merging allows the system to leverage the simplicity of each individual graph while achieving comprehensive analysis through their integration.

Inventive Principle:
Principle #5Merging (Combining)

Data Source

PatentEP3945441B1Detecting exploitable paths in application software that uses third-party libraries
Publication Date: 2024.09.04 CHECKMARX LTD
  • EP3945441B1 patent drawingFigure 1
  • EP3945441B1 patent drawingFigure 2
  • EP3945441B1 patent drawingFigure 3

AI summary

A method for software code analysis includes receiving source code of an application program, which includes one or more calls from respective entry points in the source code to a library program. The source code is automatically analyzed in order to generate a first data flow graph (DFG), representing a flow of data to be engendered upon running the application program. One or more vulnerabilities are identified in the library program. The library program is automatically analyzed to generate a second DFG linking at least one of the entry points in the source code to at least one of the vulnerabilities. The first DFG is combined with the second DFG in order to track the flow of data from the application program to the at least one of the vulnerabilities and to report at least one of the vulnerabilities as being exploitable.