Dynamic Invocation Analysis for Complete Call Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large-scale software applications with dynamic behavior pose challenges for static analysis, as conventional approaches require manual configuration and are inefficient in modeling execution paths, leading to incomplete call graphs and missed security vulnerabilities.
Innovation Solution
A method and system that divide code into trusted and untrusted components, identify dynamic invocations, extract dynamic information, and use metadata to match targets, adding edges to a call graph for precise and complete analysis, thereby improving scalability and identifying security vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional static analysis approaches are used on dynamic applications, then analysis simplicity is maintained, but call graph completeness deteriorates and security vulnerability identification fails
Solution Approach 1:
The patent segments the code into trusted and untrusted components, allowing targeted analysis of dynamic invocations in untrusted code while leveraging the static nature of trusted code. This segmentation enables complete call graph generation by separately handling static and dynamic aspects, resolving the contradiction between call graph completeness and analysis complexity
Solution Approach 2:
The patent performs preliminary static analysis to generate an initial call graph and identify potential dynamic invocations before runtime execution. By pre-processing the code to extract metadata about dynamic behavior patterns, the system prepares the foundation for complete call graph construction without requiring full runtime execution, thus improving call graph completeness while controlling analysis complexity
2Measurement precision
If manual configuration of static analysis tools is performed, then analysis accuracy may improve, but productivity deteriorates due to substantial additional effort
Solution Approach 1:
The patent implements self-service through automated metadata extraction and matching mechanisms that eliminate manual configuration requirements. The system automatically extracts dynamic invocation patterns from untrusted code, matches them with trusted code signatures, and constructs the complete call graph without human intervention, thereby maintaining high security vulnerability identification accuracy while dramatically improving analysis productivity
Solution Approach 2:
The patent changes the analysis parameters by shifting from traditional control-flow graph approaches to a metadata-driven dynamic invocation matching approach. This parameter change enables automated processing of dynamic behavior without manual configuration, resolving the contradiction between security vulnerability identification accuracy and analysis productivity
3Measurement precision
If complete call graph generation is attempted without dynamic behavior knowledge, then analysis speed is maintained, but call graph completeness deteriorates
Solution Approach 1:
The patent performs preliminary extraction of dynamic invocation metadata from the code during the static analysis phase, before complete call graph construction. This preliminary action captures essential dynamic behavior information without requiring full runtime execution, enabling complete call graph generation while avoiding the time cost of actual dynamic execution
Solution Approach 2:
The patent introduces metadata about dynamic behavior as an intermediary between static code analysis and complete call graph generation. This metadata acts as a mediator that bridges the gap between static analysis capabilities and dynamic behavior understanding, enabling complete call graph construction without requiring time-consuming runtime execution or complex dynamic analysis
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method may include dividing code into trusted and untrusted components, and identifying a dynamic invocation in a first component of the code. The first component may be an untrusted component. The method may further include extracting dynamic information from the dynamic invocation, and identifying, using the dynamic information and metadata describing a dynamic behavior of the code, a target for the dynamic invocation. The target may correspond to a second component of the code. The method may further include determining that the target matches the dynamic invocation, and in response to determining that the target matches the dynamic invocation, adding, to a call graph generated from the code, an edge from the dynamic invocation to the target.