Incremental Security Scanning via Merged Intermediate Representation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static security analysis of application code is time-intensive, making it infeasible for developers to perform on every single change, especially for large or complex applications, as conventional methods either reanalyze excessive code or ignore findings from the rest of the program.
Innovation Solution
The method involves executing a full scan of application code, saving a scan state, and performing incremental scans based on changes at a routine level, merging the saved scan state with an incremental intermediate representation to produce a merged scan state, which reduces analysis time by isolating and analyzing only the changed code.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a full scan of application code is performed to ensure comprehensive security analysis, then security finding completeness is improved, but analysis time increases significantly
Solution Approach 1:
The patent segments the application code into routines and identifies only the changed routines after modifications. Instead of reanalyzing the entire application codebase, the system divides the analysis work into individual routine segments, analyzing only those that have changed and merging them with previously analyzed segments to produce complete security findings.
2Loss of time
If incremental scanning is performed on only changed code to reduce analysis time, then analysis time is reduced, but security finding completeness may be compromised
Solution Approach 1:
The patent merges the incremental intermediate representation (IR) of changed routines with the previously saved scan state of the rest of the application. This combining approach ensures that security findings from both the changed portions and the unchanged portions are integrated, maintaining comprehensive security analysis coverage while reducing reanalysis time.
Solution Approach 2:
The system performs a preliminary full scan of the application code and saves the scan state (including intermediate representation and security findings) before any modifications. This preliminary analysis result is stored and reused during incremental scans, eliminating the need to reanalyze unchanged code and maintaining finding completeness.
3Manufacturing precision
If conventional static security analysis is performed on every change, then security analysis thoroughness is improved, but developer productivity deteriorates due to time constraints
Solution Approach 1:
The patent implements a dynamic scanning approach that adapts to the nature of code changes. The system automatically determines whether to perform a full scan or an incremental scan based on the change context, dynamically adjusting the analysis scope to maintain thoroughness while minimizing disruption to developer workflow and productivity.
Data Source
AI summary
A computer-implemented method for security scanning application code includes executing, via a processor, a full scan of the application code and generating a program intermediate representation (IR) and a list of security findings determined by the full scan. The processor executes an incremental scan of the application code after at least one change to the application code, and identifies at least one changed file in the application code. The processor then generates an incremental intermediate representation (IR) based at least in part on the at least one changed file. The processor merges the saved scan state and the incremental IR, produces a merged scan state, and outputs security findings based at least in part on the merged scan state and the incremental IR.