Dynamic Sanitizer Detection in Static Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static Application Security Testing (SAST) tools face limitations in detecting sanitizers due to incomplete pre-defined lists, leading to false positives and false negatives, as they cannot identify unknown sanitizers or assess their functionality effectively.
Innovation Solution
The method combines static and dynamic analysis to identify and test potential sanitizers within a sandboxed environment, generating test cases based on sanitizer contexts and executing them to determine their functionality, thereby providing combined results with prioritization for accurate detection.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a pre-defined list of sanitizers is used in SAST tools, then the detection process is simplified and faster, but the completeness and accuracy of sanitizer detection deteriorates due to incomplete lists and inability to identify unknown sanitizers
Solution Approach 1:
The patent transitions from a static pre-defined sanitizer list to a dynamic detection approach where sanitizers are identified at runtime through dynamic analysis. The system executes test cases against candidate sanitizers to validate their functionality, allowing the sanitizer list to adapt and grow based on actual program behavior rather than relying on a fixed, pre-computed list.
Solution Approach 2:
The system enables the program itself to identify its own sanitizers through dynamic analysis and self-testing. By executing test cases generated from static analysis results and observing actual runtime behavior, the system allows the code to demonstrate which functions act as sanitizers, rather than requiring external pre-definition of all possible sanitizers.
2Loss of time
If a pre-defined list of sanitizers is used, then manual analysis effort is reduced, but false positive and false negative rates increase due to incomplete and coarse-grained information
Solution Approach 1:
The system performs preliminary static analysis to generate test cases and identify candidate sanitizers before dynamic execution. This preliminary action prepares the testing framework and candidate list in advance, allowing the dynamic analysis phase to focus specifically on validating sanitizer functionality rather than performing complete analysis from scratch.
Solution Approach 2:
The system implements a feedback loop where dynamic analysis results are used to validate candidate sanitizers and update the sanitizer list. Test case execution outcomes provide feedback on whether candidate functions actually sanitize data, allowing the system to refine its sanitizer identification accuracy and reduce false positives and negatives in subsequent analyses.
3Duration of action of moving object
If static analysis alone is used to identify sanitizers, then the analysis process is faster and requires no execution, but the detection capability deteriorates due to inability to assess actual sanitizer functionality
Solution Approach 1:
The patent divides the sanitizer detection process into two distinct segments: static analysis phase that generates test cases and identifies candidate sanitizers without execution, and dynamic analysis phase that executes test cases to validate functionality. This segmentation allows each phase to specialize in its strength while compensating for the other's limitations.
Solution Approach 2:
Static analysis performs preliminary work by generating test cases and identifying candidate sanitizers before dynamic execution. This preliminary action prepares the groundwork for dynamic validation, allowing the faster static phase to handle broad identification while the slower dynamic phase focuses on precise functionality verification.
Data Source
AI summary
Methods, systems, and computer-readable storage media for analyzing security of dataflows in programs. In some implementations, actions include processing source code using static analysis to: identify one or more dataflows and one or more candidate sanitizers, each candidate sanitizer being associated with a respective dataflow, and provide an executable sub-program for each candidate sanitizer to provide one or more executable sub-programs, processing the one or more executable sub-programs using dynamic analysis to: execute the one or more executable sub-programs, and provide dynamic analysis results, providing combined results based on the static analysis and the dynamic analysis, the combined results including the dynamic analysis results, and assigning a priority to each result in the combined results.