Hybrid Code Modification for Runtime Security Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software analysis programs fail to effectively detect security vulnerabilities in software applications during runtime, as they often lack access to all source code and cannot test internal code paths or behaviors that occur during actual execution.
Innovation Solution
A runtime analysis framework (RTA) embeds rules inside software applications to detect security vulnerabilities by assigning input tags to user requests and sanitization tags to security checks, allowing for the identification of vulnerabilities without accessing source code, using a hybrid code modification scheme that modifies the programming language platform and software application at post-compile and runtime stages.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security analysis programs test every path through source code, then security vulnerability detection coverage is improved, but access to all application source code is required which increases system complexity and is not always feasible
Solution Approach 1:
The patent introduces bytecode as an intermediary representation between source code and executable code. By analyzing bytecode instead of requiring direct source code access, the system can detect security vulnerabilities in compiled code paths without needing access to the original source code, thus resolving the contradiction between detection coverage and access complexity
Solution Approach 2:
The patent creates a copy of the application's bytecode representation for analysis purposes. This bytecode copy contains all the logical paths and control flow information needed for security analysis, allowing comprehensive vulnerability detection without requiring access to the actual source code, thereby reducing the access complexity while maintaining detection coverage
2Ease of operation
If analysis programs provide snapshot views of source code, then analysis simplicity is improved, but runtime behaviors and states during actual execution cannot be tested which reduces detection accuracy
Solution Approach 1:
The patent transitions from static snapshot analysis to dynamic bytecode analysis that tracks runtime behaviors. By instrumenting the bytecode execution to monitor variable states, control flow changes, and data transformations during actual execution, the system achieves both operational simplicity and high runtime detection accuracy
Solution Approach 2:
The patent implements feedback mechanisms where the bytecode analysis tool continuously monitors runtime execution states and feeds this information back for vulnerability detection. This allows the system to detect vulnerabilities based on actual runtime behaviors and states, improving measurement precision while maintaining ease of operation through automated feedback loops
3Ease of operation
If security analysis is performed without accessing source code, then ease of operation is improved, but the ability to detect internal code paths for security flaws is reduced which worsens detection coverage
Solution Approach 1:
Bytecode serves as an intermediary that preserves all internal code path information from the original source code while being accessible without source code. The bytecode contains complete control flow graphs, variable definitions, and data flow information, enabling comprehensive internal code path analysis without requiring source code access, thus resolving the contradiction between ease of operation and detection capability
Data Source
AI summary
Computer program, methods, and systems for code modification of a programming language platform and a software application in an intermediate language at different times are disclosed. The methods and system may modify a portion of the programming language platform in the intermediate language at a first time to alter a functionality of or add a new functionality to the programming language platform; and may modify the software application in the intermediate language at a second time different from the first time, where the software application may be modified based on a runtime analysis rule that uses the altered or added new functionality of the programming language platform. The modified programming language platform may be included in a first package, and the modified software application may be included in a second package, and executed on the modified programming language platform.