Information Flow Analysis for Application Code Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing approaches for vulnerability detection in cloud application development are inadequate, particularly in continuous integration and deployment settings, as they often rely on dynamic analysis with low code coverage and high false positives, and static methods are prohibitive or result in excessive false positives.
Innovation Solution
A system and method for information flow analysis of application code using semantic code property graphs to detect vulnerabilities by tracing data flows and enforcing security policies, providing a richer understanding of data operations and transformations across the code base.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If dynamic approaches for program analysis are used, then vulnerability detection can be performed at runtime, but code coverage is low and integration into development process is complex
Solution Approach 1:
The system segments the codebase into function-level units and processes them independently through parallel analysis. Each function is analyzed separately to extract data flows and evaluate security policies, which reduces integration complexity while maintaining comprehensive coverage across the entire codebase.
Solution Approach 2:
The patent introduces an intermediary layer that connects code analysis with security policy evaluation. This intermediary processes function summaries and data flows to determine policy violations, simplifying the integration process by providing a standardized interface between static analysis and security requirements.
2Reliability
If static taint tracking and symbolic execution are used, then comprehensive code analysis is achieved, but runtime is prohibitive and false positives are high
Solution Approach 1:
The system performs partial static analysis by focusing only on essential data flow information at the function level rather than进行全面 whole-program analysis. It extracts key data flows and security-relevant variables without executing complete symbolic analysis, thereby reducing runtime while maintaining sufficient code coverage for vulnerability detection.
Solution Approach 2:
The patent extracts only the necessary data flow information from functions, specifically focusing on data flows that are relevant to security policy evaluation. By taking out and analyzing only the essential data flow characteristics rather than complete program states, the system reduces analysis time and false positives while maintaining detection accuracy.
3Reliability
If existing static analyzers are used, then vulnerability detection is performed, but false positive rates are high and detection accuracy is limited
Solution Approach 1:
The system implements feedback mechanisms where function summaries and data flow analysis results are used to inform security policy evaluations. The parallel analysis approach provides feedback loops that refine vulnerability detection by cross-validating findings across multiple analysis dimensions, thereby reducing false positives and improving detection precision.
Solution Approach 2:
The patent creates a universal analysis framework that handles multiple security policies and vulnerability types through a single unified approach. The system evaluates diverse security policies (confidentiality, integrity, availability) using the same data flow extraction and evaluation mechanisms, improving measurement precision by providing consistent and comprehensive vulnerability detection across different security contexts.
Data Source
AI summary
A method and system for security flow analysis of application code comprising: detecting data flows in a code base; and extracting an information flow, comprising determining a primary data flow by identifying a data flow that contains exposed data, and extending the primary data flow through descriptor data flows, wherein the descriptor data flows are associated with the set of data tracked by the primary data flow; wherein the information flow is a high level flow description that exposes the application code vulnerabilities based on the primary data flow and all associated descriptor data flows.