Observability Controls for Vulnerable Code Segments

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Modern software programs face challenges in detecting and addressing vulnerabilities due to the reuse of code across multiple applications, leading to hidden vulnerabilities that are not easily identifiable through traditional testing methods, resulting in preventable exploits.

Innovation Solution

An observability intelligence platform is used to instrument vulnerable portions of software programs with observability controls, allowing for dynamic configuration of observability information collection, identification of vulnerabilities, and adaptive logging to balance risk and cost considerations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If code reuse is practiced across software programs, then development speed and consistency are improved, but vulnerability detection becomes more difficult and security risks increase

Engineering Contradiction:

Improvedevelopment speedVSAvoidvulnerability detection

Core Design Contradiction:

ProductivityVSDifficulty of detecting and measuring

Solution Approach 1:

The system segments codebases into distinct software programs while tracking shared code segments. By dividing the monitoring scope and associating observability data with specific program instances rather than just code segments, the system enables vulnerability detection in reused code without sacrificing the benefits of code reuse. Each program instance can be monitored independently despite sharing common code libraries.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces an intermediary observability control layer between the code execution and security analysis. This intermediary collects and correlates observability data from multiple programs that share common code segments, enabling vulnerability detection without requiring direct analysis of every code path in every program. The intermediary aggregates data to identify patterns that indicate vulnerabilities in reused code.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Difficulty of detecting and measuring

If observability controls are instrumented to monitor vulnerable portions of code, then vulnerability detection capability is improved, but resource overhead and collection cost increase

Engineering Contradiction:

Improvevulnerability detection capabilityVSAvoidresource overhead

Core Design Contradiction:

Difficulty of detecting and measuringVSLoss of energy

Solution Approach 1:

Instead of instrumenting all code uniformly, the system applies observability controls selectively to specific local portions of code identified as vulnerable through static analysis. By targeting only the vulnerable segments rather than the entire codebase, the system reduces resource overhead while maintaining effective vulnerability detection capability in the critical areas.

Inventive Principle:

Principle #3Local quality

Solution Approach 2:

The patent implements partial instrumentation by collecting observability data only from selected code segments rather than all execution paths. This partial action approach balances detection capability with resource consumption, focusing monitoring efforts on the most critical vulnerable portions while avoiding the excessive overhead of comprehensive instrumentation.

Inventive Principle:

Principle #16Partial or excessive action

3Loss of information

If comprehensive observability data collection is implemented, then vulnerability visibility is improved, but cost and resource consumption increase

Engineering Contradiction:

Improvevulnerability visibilityVSAvoiddata collection volume

Core Design Contradiction:

Loss of informationVSQuantity of substance

Solution Approach 1:

The system extracts and focuses on specific observability data related to vulnerable code segments rather than collecting all program execution data. By taking out only the relevant observability information from the broader data stream, the system maintains vulnerability visibility while significantly reducing data collection volume and associated costs.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent segments observability data collection by program instance and by code segment. This segmentation allows the system to collect comprehensive data where needed (in vulnerable portions of specific programs) while excluding data from non-vulnerable areas, thereby maintaining necessary visibility without the cost of comprehensive universal collection.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentUS20240143777A1Instrumenting observability controls

Publication Date: 2024.05.02 CISCO TECHNOLOGY INC

AI summary

In one embodiment, a device may identify one or more vulnerable portions of a program to be observed based on security vulnerability information. The device may instrument the program with an observability control to configure collecting of observability information regarding the one or more vulnerable portions of the program. The device may modify the observability control based on one or more attributes associated with the collecting of the observability information regarding the one or more vulnerable portions of the program. The device may the observability information regarding the one or more vulnerable portions of the program according to the observability control as modified.