Guided Security Analysis via Callgraph-Based Input Modification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamic analysis techniques for security vulnerability detection in web applications are computationally expensive and do not scale well to large codebases, often focusing on coverage of user-defined functionality rather than finding security vulnerabilities, and fail to provide sufficient scope of coverage due to the combinatorial number of possible event sequences and states.
Innovation Solution
A method involving static analysis to generate a callgraph that includes event handlers, selecting relevant states and events, obtaining inputs, and generating input modification rules to bypass guards controlling access to points of interest, thereby guiding the security analysis efficiently and effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If dynamic analysis techniques are used for security vulnerability detection, then coverage of user-defined functionality is improved, but computational cost increases and scalability deteriorates
Solution Approach 1:
The patent performs static analysis before dynamic analysis to generate a callgraph and identify relevant event handlers and states in advance. This preliminary action filters out irrelevant code paths, allowing the subsequent dynamic analysis to focus only on security-relevant areas, thereby reducing computational cost while maintaining coverage of user-defined functionality.
Solution Approach 2:
The patent segments the analysis process into distinct phases: static analysis for callgraph generation, state selection, event selection, and dynamic analysis. This segmentation allows each phase to be optimized independently and enables the system to handle large codebases by processing them in manageable chunks rather than attempting to analyze everything at once.
2Reliability
If comprehensive dynamic analysis is performed to cover all possible event sequences, then security vulnerability detection coverage is improved, but analysis time and computational resources increase
Solution Approach 1:
The static analysis phase preliminarily identifies and selects only the most relevant event handlers and states based on the callgraph and security criteria. This pre-filtering ensures that the subsequent dynamic analysis operates on a reduced set of critical paths, maintaining comprehensive security coverage while significantly reducing the total number of event sequences that need to be executed and analyzed.
Solution Approach 2:
The patent applies different analysis depths and strategies to different parts of the codebase based on their security relevance. States and events identified as security-critical through static analysis receive intensive dynamic analysis, while less critical areas are analyzed more lightly or skipped entirely, optimizing the balance between detection coverage and analysis time.
3Adaptability or versatility
If input modification rules are generated to bypass guards, then access to points of interest is improved, but complexity of input generation increases
Solution Approach 1:
The system generates input modification rules based on feedback from executing event handlers and observing the resulting states. By analyzing the outcomes of these executions, the system automatically derives rules for modifying inputs to bypass guards, making the input generation process adaptive and intelligent rather than requiring complex manual specification.
Solution Approach 2:
The input generation system uses the execution results of event handlers themselves to generate the input modification rules. The system leverages the feedback from the code's own execution to create the rules needed to bypass guards and reach points of interest, making the process self-sufficient and reducing the need for external complexity.
Data Source
AI summary
A method may include generating a callgraph by performing a static analysis of code that includes event handlers, and selecting, using the callgraph, a state of the code, selecting, using the callgraph, an event enabled in the selected state. The event corresponds to an event handler. The method may further include obtaining an input, obtaining a next state by executing the event handler with the obtained input in the selected state, in response to executing the event handler, generating an input modification rule using the obtained input, and generating, using the input modification rule and the obtained input, a modified input that bypasses a guard in the code that controls access to the point of interest.