Hybrid Vulnerability Detection via Call-Tree Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security scanning of software applications through black-box scanning and static program analysis has limitations, as black-box scanning may not cover all scenarios and static analysis may miss vulnerabilities that require specific parameter values to flow to security sinks.
Innovation Solution
A hybrid approach combining black-box scanning and static analysis, where a call-tree representation of call stacks is recorded during black-box scanning, and static analysis is performed to determine parameter values that, when abstracted, drive execution to security sinks, generating a security report identifying vulnerable information flows.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If black-box scanning is performed to test application security by simulating attacks, then security vulnerability detection is improved, but coverage of all possible execution scenarios is insufficient
Solution Approach 1:
The patent combines black-box scanning and static program analysis into a hybrid security analysis system. The black-box scanner executes test inputs and records call-stack traces, while the static analysis component processes source code to identify additional vulnerable paths. This merging allows the system to leverage both dynamic execution testing and static code analysis, achieving comprehensive scenario coverage while maintaining high vulnerability detection accuracy.
2Device complexity
If static program analysis is performed on source code to identify vulnerabilities, then code structure analysis is improved, but detection of vulnerabilities requiring specific parameter values is missed
Solution Approach 1:
The patent introduces call-stack traces as an intermediary data structure that bridges static program analysis and black-box scanning results. The system performs static analysis to identify potential vulnerable paths in the source code, then uses recorded call-stack traces from black-box scanning to verify whether these paths can actually be executed with specific parameter values. This intermediary approach allows static analysis to provide comprehensive code structure coverage while using execution traces to confirm actual vulnerability existence.
3Ease of operation
If only black-box scanning is used, then ease of operation is maintained, but security confidence level is insufficient
Solution Approach 1:
The patent performs preliminary static analysis on the application source code to identify potential vulnerable paths before executing black-box scanning. This preliminary action creates a set of candidate vulnerable paths that guide the black-box scanning process, allowing the system to focus testing efforts on high-risk areas. The combination of preliminary static analysis results with actual black-box scanning execution provides both operational simplicity and high security confidence level.
Data Source
AI summary
Arrangements described herein relate to analyzing vulnerable information flows in an application. A black-box scan of the application can be performed to record a call-tree representation of call stacks arising in the application due to test inputs provided during the black-box scan. For each path in the call-tree representation that does not constitute a vulnerable information flow during the black-box scan, a static analysis can be performed to determine at least one parameter value that, when abstracted, drives execution of the application, via the path, to flow to the at least one security sink. A security report can be generated identifying at least one of the paths in the call-tree representation that does not constitute the vulnerable information flow during the black-box scan, but flows to the at least one security sink when the at least one parameter value is abstracted.