Dynamic Security Scan Coverage Assessment via Static Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamic security scans lack objective assessment methods, as their effectiveness is typically determined by the number of vulnerabilities identified, which can be influenced by the quality of the web application rather than the scan's quality, leading to inaccurate evaluations.
Innovation Solution
Combining runtime analysis and static code analysis to determine the attack surface coverage of dynamic security scans, allowing for an objective assessment of the scan's quality by measuring the proportion of the attack surface covered during the scan.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic security scans are performed as black-box tests without access to source code, then the scans can identify security vulnerabilities through actual attacks, but the effectiveness of the scan cannot be objectively assessed
Solution Approach 1:
The patent introduces static code analysis as an intermediary tool that provides source code information to the dynamic security scan system. This intermediary enables the black-box scanner to obtain attack surface information without breaking the black-box testing paradigm, allowing for objective assessment of scan effectiveness while maintaining the original scanning approach.
Solution Approach 2:
The patent segments the security assessment process into two independent components: static code analysis (which determines attack surface) and dynamic security scanning (which identifies vulnerabilities). This segmentation allows each component to be evaluated separately and combined to provide comprehensive objective assessment, resolving the measurement precision issue without complicating the overall system.
2Measurement precision
If the number of vulnerabilities identified is used to determine scan effectiveness, then the assessment is simple to perform, but the evaluation is inaccurate because it depends on web application quality rather than scan quality
Solution Approach 1:
The patent replaces the mechanical counting method (simply counting vulnerabilities) with a more sophisticated measurement system that uses static code analysis to determine attack surface. This substitution provides accurate scan quality evaluation by comparing actual vulnerabilities found against the known attack surface, rather than relying on raw vulnerability counts that are influenced by application quality.
3Measurement precision
If static code analysis is performed to identify data entry points and determine attack surface size, then objective assessment becomes possible, but the overall system complexity increases
Solution Approach 1:
The patent performs static code analysis as a preliminary action before the dynamic security scan. By determining the attack surface in advance, the system establishes a baseline for measuring scan effectiveness. This preliminary action separates the measurement function from the scanning function, making the overall system more manageable despite the added complexity.
Data Source
AI summary
Example embodiments relate to assessing dynamic security scans using runtime analysis and static code analysis. In example embodiments, a system performs static code analysis of a web application to identify reachable code and/or data entry points, where the data entry points are used to determine an attack surface size for the web application. At this stage, the system may initiate runtime monitoring for a dynamic security scan of the web application, where the runtime monitoring detects invocation of a statement at one of the data entry points. The invocation is logged as an invocation entry that comprises invocation parameters and/or code units that were executed in response to the invocation. The system may then determine an attack surface coverage of the dynamic security scan using the invocation entry and the attack surface size and/or a reachable code coverage using the invocation entry and the reachable code.