Hybrid String Representation for Static Security Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static security analysis, particularly taint analysis, faces imprecision due to the lack of explicit representation of untrusted values, leading to false positives and scalability issues with existing string analysis algorithms.
Innovation Solution
A hybrid string representation method is introduced, where string components are determined to be either concretely represented by comparing them to known concretizations or abstracted, creating a hybrid representation that includes both concrete and abstract components, allowing for more accurate security analysis by leveraging concrete information to reduce false reports.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If fully concrete string values are tracked during static analysis, then measurement precision is improved, but device complexity increases and productivity decreases due to unbounded state space
Solution Approach 1:
The patent segments string values into two distinct parts: concrete components (fixed, attacker-controlled values) and abstract components (variable, untrusted values). This segmentation allows the analysis system to track only the necessary concrete portions while abstracting away the unbounded variable portions, thereby improving precision without incurring the full complexity of tracking entirely concrete values.
Solution Approach 2:
The patent applies local quality by treating different parts of string values differently based on their security properties. Concrete components that are fixed and attacker-controlled receive precise tracking, while abstract components that are variable and untrusted receive symbolic representation. This localized approach to precision allows the system to focus computational resources on the most critical security-relevant portions of the data.
2Measurement precision
If fully concrete string values are tracked during static analysis, then measurement precision is improved, but productivity decreases due to unbounded state space
Solution Approach 1:
The patent segments string values into concrete and abstract components, allowing the analysis to proceed efficiently by tracking only the bounded concrete portions while using symbolic representations for the unbounded abstract portions. This segmentation prevents the exponential state space explosion that would occur with full concrete tracking, thereby maintaining productivity.
Solution Approach 2:
The patent changes the representation parameter of string values from fully concrete to a hybrid concrete-abstract form. This parameter change allows the analysis system to work with a bounded state space while maintaining precision for security-critical concrete components, thus improving productivity without sacrificing measurement precision.
3Productivity
If abstract string representations are used, then productivity is improved, but measurement precision deteriorates leading to false positives
Solution Approach 1:
The patent segments string representations into concrete components (for precise tracking) and abstract components (for efficient processing). This segmentation enables the system to maintain high productivity through symbolic processing of abstract portions while achieving high precision through concrete tracking of security-relevant portions, thereby eliminating false positives without sacrificing speed.
Solution Approach 2:
The patent applies local quality by providing high-precision concrete representation for security-critical string components and efficient abstract representation for non-critical portions. This localized precision strategy ensures that false positives are eliminated for the most important security checks while maintaining overall productivity through efficient abstract processing of less critical data.
Data Source
AI summary
Methods for creating a hybrid string representation include determining string components from input string information that may be represented concretely by comparing the one or more components to a set of known concretizations using a processor. The set of known concretizations includes string configurations that cannot be interfered with by an attacker. All string components that could not be represented concretely are abstracted. A hybrid string representation is created that includes at least one concrete string component and at least one abstracted string component.