External Dependency Flaw Detection for Deployed Applications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Deployed servers face challenges in systematically and continuously protecting themselves from security flaws and vulnerabilities in third-party dependencies due to the inconsistent pace of flaw disclosure and the massive number of components they use, leading to a significant security threat.
Innovation Solution
A method and apparatus that obtain a list of dependencies used by a deployed application, map them to a flaws database to identify known flaws, and report potential flaws to developers without executing monitoring processes on the deployment platform, utilizing an external processing apparatus to mitigate resource constraints and handle various deployment platforms like FaaS and PaaS.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional monitoring tools are used to track dependencies and vulnerabilities, then security monitoring capability is improved, but processing overhead and resource consumption on the deployment platform increase
Solution Approach 1:
The patent extracts the security monitoring function from the deployment platform by introducing an external security analysis system. This external system independently obtains dependency information, maps it to vulnerability databases, and generates security reports without executing monitoring processes on the deployment platform itself, thereby eliminating processing overhead while maintaining security monitoring capability.
Solution Approach 2:
The patent introduces an intermediary external security analysis system that acts as a mediator between the deployment platform and vulnerability databases. This intermediary obtains dependency information through APIs, performs security analysis externally, and returns results to the platform, preventing direct resource consumption on the platform while enabling continuous security monitoring.
2Reliability
If comprehensive dependency tracking is implemented across all servers, then security coverage is improved, but system complexity and resource requirements increase
Solution Approach 1:
The patent creates a universal external security analysis system that can analyze dependencies across multiple deployment platforms and servers through standardized APIs. This single external system provides comprehensive security coverage for all servers by mapping their dependencies to vulnerability databases, eliminating the need for separate monitoring tools on each server and reducing overall system complexity.
Solution Approach 2:
The patent uses copying by obtaining dependency information through APIs that replicate the dependency data without requiring direct access to or modification of the actual deployment systems. The external system creates a virtual model of the dependency landscape and performs security analysis on this copy, enabling comprehensive coverage without increasing operational complexity of the original systems.
3Measurement precision
If continuous security updates are performed on deployed applications, then vulnerability detection is improved, but processing resources and time consumption increase
Solution Approach 1:
The patent applies preliminary action by maintaining continuously updated vulnerability databases that contain known flaws and security issues before they affect deployed applications. The external security analysis system periodically queries these pre-updated databases against current dependency information, enabling rapid vulnerability detection without requiring time-consuming real-time analysis when new vulnerabilities are disclosed.
Solution Approach 2:
The patent implements periodic action by having the external security analysis system continuously and periodically query the vulnerability database and re-analyze dependency information at scheduled intervals. This periodic re-analysis ensures that newly disclosed vulnerabilities are detected promptly while allowing the system to operate efficiently during intervals between analyses, balancing detection accuracy with resource consumption.
Data Source
AI summary
Flaws in dependencies of deployed applications are identified. In one embodiment, a list of dependencies used by a deployed application that is deployed on the deployment platform is obtained. Each dependency of the list of dependencies is mapped with a flaws database, wherein the flaws database comprising an indication of known flaws for different dependencies and different versions thereof. Based on such mapping, one or more flaws in the deployed application are determined. The determination is performed externally to the deployment platform and without executing a monitoring process thereon.