Data Flow Graph Analysis for Exploitable Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software analysis tools fail to effectively distinguish between exploitable and non-exploitable vulnerabilities in library programs used by application programs, leading to false positive results and inefficient resource allocation for security threats.
Innovation Solution
A method and apparatus that generate and combine data flow graphs (DFGs) for both application and library programs to track data flows, identifying vulnerabilities and determining their exploitable status by linking application entry points to library vulnerabilities, using a database of known vulnerabilities and API invocations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing software analysis tools are used to detect vulnerabilities in library programs, then vulnerabilities can be identified, but false positive results increase and resource allocation efficiency decreases
Solution Approach 1:
The patent segments the data flow analysis into two distinct graphs: an application-level DFG showing data flow from application inputs to library function calls, and a library-level DFG showing data flow from library function calls to vulnerable parameters. This segmentation allows precise tracking of which application inputs actually reach which library vulnerabilities, eliminating false positives while maintaining comprehensive coverage.
Solution Approach 2:
The patent introduces an intermediary mechanism that combines the application DFG and library DFG through library function call nodes. This intermediary structure acts as a bridge that correlates application inputs with library vulnerabilities through the actual data flow paths, enabling accurate determination of exploitability without requiring direct analysis of all possible paths.
2Measurement precision
If comprehensive data flow analysis is performed to track all data flows from application inputs to library vulnerabilities, then exploitable vulnerabilities can be accurately identified, but analysis complexity increases
Solution Approach 1:
The patent divides the complex analysis system into two separate but complementary data flow graphs: an application-level DFG that captures data flow from application inputs to library function calls, and a library-level DFG that captures data flow from library function calls to vulnerable parameters. This segmentation reduces the complexity of analyzing the entire system at once while maintaining the ability to trace complete data flow paths when needed.
Solution Approach 2:
The patent merges the application DFG and library DFG by combining them at the library function call nodes, creating a unified view that enables complete data flow tracing from application inputs to library vulnerabilities. This merging allows the system to leverage the simplicity of each individual graph while achieving comprehensive analysis through their integration.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method for software code analysis includes receiving source code of an application program, which includes one or more calls from respective entry points in the source code to a library program. The source code is automatically analyzed in order to generate a first data flow graph (DFG), representing a flow of data to be engendered upon running the application program. One or more vulnerabilities are identified in the library program. The library program is automatically analyzed to generate a second DFG linking at least one of the entry points in the source code to at least one of the vulnerabilities. The first DFG is combined with the second DFG in order to track the flow of data from the application program to the at least one of the vulnerabilities and to report at least one of the vulnerabilities as being exploitable.