Dynamic Application Component Auditor for Runtime Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods fail to accurately audit application components for vulnerabilities in a production environment due to performance and resource constraints, leading to undetected risks from third-party libraries with known published vulnerabilities.
Innovation Solution
A dynamic application component auditing method that automatically identifies components, converts manifest information using an alias file to match with a vulnerability database, and generates reports and alerts for vulnerabilities, enabling continuous monitoring and preventative actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static pre-production scanning is used to audit application components, then the auditing process is simple and resource-consuming, but it cannot identify vulnerabilities discovered after product release and lacks continuous monitoring capability
Solution Approach 1:
The patent implements dynamic auditing by deploying an agent within the application runtime environment that continuously monitors and audits application components during execution. This transforms the static pre-production scanning approach into a dynamic runtime auditing system, enabling continuous vulnerability detection without requiring separate production resources.
Solution Approach 2:
The patent introduces an alias file as an intermediary layer between the application components and the vulnerability database. This alias file maps application component identifiers to vulnerability database identifiers, enabling accurate matching and resolution of vulnerabilities without direct complex queries to the vulnerability database during runtime.
2Reliability
If dynamic runtime auditing is implemented to continuously monitor vulnerabilities, then continuous vulnerability identification is enabled, but performance and resource constraints are exacerbated
Solution Approach 1:
The patent enables continuous vulnerability monitoring by deploying an agent that operates throughout the application runtime, continuously auditing components and identifying vulnerabilities as they are discovered in the vulnerability database, rather than performing periodic or static scans.
Solution Approach 2:
The patent performs partial auditing by focusing only on application components that have changed or been updated, rather than auditing the entire application footprint continuously. This selective approach reduces runtime resource consumption while maintaining effective vulnerability detection.
3Measurement precision
If comprehensive component auditing is performed to accurately match vulnerabilities, then detection precision is improved, but the complexity of converting and matching manifest information increases
Solution Approach 1:
The patent performs preliminary action by pre-processing and storing mapping relationships between application component identifiers and vulnerability database identifiers in an alias file during application deployment or component installation. This pre-established mapping enables rapid and accurate matching during runtime auditing without complex real-time conversion processes.
Data Source
AI summary
In one embodiment, a process on a computer for dynamic application component auditing is disclosed, the process includes automatically identifying, by an agent, all application components in an application. The process includes determining, by the agent, manifest information for the identified application components. The process includes accessing, by the agent, an alias file to convert the determined manifest information to align with corresponding information in a vulnerability database. The process includes using a Web service to query the vulnerability database to search for a match with the converted manifest information. The process includes responsive to the query, creating an audit report of the application components.