Fuzzing Execution Flow Analysis for Vulnerability Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional methods for identifying vulnerabilities in software applications, such as web applications, are prone to false positives and often fail to detect potential security vulnerabilities due to their lack of awareness of the application's functionality, leading to inefficient and ineffective security scanning processes.

Innovation Solution

A system that analyzes the execution flow of a software application in conjunction with received requests to identify vulnerabilities by using a fuzzer component and a correlation engine, which generates and analyzes requests to determine parameter sets that trigger 'interesting' functions, thereby optimizing the fuzzing process and increasing code coverage.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If conventional fuzzing methods are used to test application robustness, then various input payloads can be provided to identify potential vulnerabilities, but the process generates many false positives and fails to detect vulnerabilities due to lack of awareness of application functionality

Engineering Contradiction:

Improvevulnerability detection accuracyVSAvoidfalse positive rate

Core Design Contradiction:

Measurement precisionVSReliability

Solution Approach 1:

The system implements feedback by monitoring the execution flow of the application in response to fuzzing inputs and using this information to guide subsequent fuzzing decisions. The correlation engine analyzes whether interesting functions are executed and feeds this information back to the fuzzer to adjust the fuzzing strategy, thereby improving detection accuracy and reducing false positives.

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The system performs self-service by automatically analyzing its own fuzzing results and execution flows without external intervention. The correlation engine autonomously determines whether executed functions are interesting and self-adjusts the fuzzing process based on the analyzed feedback, enabling the system to improve its own vulnerability detection capabilities.

Inventive Principle:

Principle #25Self-service

2Productivity

If random fuzzing inputs are used to test application robustness, then coverage of various input scenarios can be achieved, but the process is inefficient and time-consuming

Engineering Contradiction:

Improvevulnerability identification efficiencyVSAvoidfuzzing process duration

Core Design Contradiction:

ProductivityVSLoss of time

Solution Approach 1:

The system applies dynamics by making the fuzzing process adaptive rather than static. The fuzzer dynamically adjusts its input generation strategy based on real-time feedback from the correlation engine about which interesting functions are executed. This dynamic adaptation allows the system to focus on high-value targets and significantly improve efficiency while reducing the time required to identify vulnerabilities.

Inventive Principle:

Principle #15Dynamics

3Measurement precision

If comprehensive code coverage is pursued through extensive fuzzing, then more vulnerabilities may be detected, but the computational resources and time required increase significantly

Engineering Contradiction:

Improvecode coverageVSAvoidcomputational resource consumption

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The system applies local quality by focusing computational resources on specific high-value targets rather than uniformly distributing effort across all code. The correlation engine identifies interesting functions that are most likely to contain vulnerabilities and directs fuzzing efforts toward inputs that trigger these specific functions, thereby achieving effective code coverage with reduced computational resource consumption.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS10846410B2Automated fuzzing based on analysis of application execution flow

Publication Date: 2020.11.24 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Described herein is a system and method for identifying a vulnerability of an application (e.g., web application). A message comprising a request and associated execution flow of the application in response to the request is received. The message is analyzed to determine whether the execution flow includes a function pre-defined as interesting. In response to determining that the execution flow includes the function pre-defined as interesting, a determination is made that the function pre-defined as interesting comprises a vulnerability of the application. In response to determining that the function pre-defined as interesting comprises a vulnerability of the application, an action is taken with respect to the vulnerability. The action can include, for example, providing information regarding the identified vulnerability and/or blocking execution of particular code of the application.