Ontology-Based Data Flow Analysis for Undefined Vulnerabilities
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing vulnerability assessment and penetration testing methods struggle to identify undefined vulnerabilities and require extensive rule sets for comprehensive analysis, leading to increased cost and time, especially when focusing on data flows in systems.
Innovation Solution
An analysis condition generating apparatus and method that uses ontology to automatically generate analysis conditions for security risk assessment by transforming data flow graphs into abstraction identifiers, enabling efficient analysis of undefined vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If vulnerability assessment is performed comprehensively on the entire system, then the coverage of vulnerability detection is improved, but the time and cost required for analysis increases
Solution Approach 1:
The patent segments the vulnerability assessment process into two distinct phases: (1) data flow graph generation that identifies all possible data paths through the system, and (2) threat list matching that selectively analyzes only those data flows relevant to specific threats. This segmentation allows comprehensive coverage without requiring exhaustive analysis of all system components, thereby reducing analysis time while maintaining detection coverage.
Solution Approach 2:
The patent performs preliminary action by generating the data flow graph before conducting the actual vulnerability assessment. The data flow graph pre-identifies all possible data paths, communication channels, and information flows in the system. This preliminary structuring enables the subsequent threat analysis to quickly match threats against pre-identified relevant paths rather than searching through the entire system, significantly reducing analysis time.
2Measurement precision
If penetration test is performed on specific invasion methods, then the analysis precision for known threats is improved, but the ability to detect undefined vulnerabilities deteriorates
Solution Approach 1:
The patent creates a universal data flow graph that represents all possible data paths, communication channels, and information flows in the system, independent of specific threat types. This universal structure serves multiple functions: it enables precise matching of known threats through the threat list while simultaneously providing a comprehensive framework for detecting undefined vulnerabilities. The same data flow graph can be used to analyze any threat type without requiring separate analysis models, thus achieving both precision and versatility.
3Reliability
If extensive rule sets are used for comprehensive system analysis, then the detection capability is improved, but the device complexity increases
Solution Approach 1:
The patent extracts only the essential structural information about data flows from the system into a simplified data flow graph representation. Instead of using extensive rule sets to model all possible vulnerability scenarios, the invention extracts the fundamental data paths, communication channels, and information flows into a compact graphical structure. This extraction reduces complexity by focusing only on the essential elements needed for vulnerability assessment while maintaining detection capability.
Solution Approach 2:
The data flow graph serves as an intermediary structure between the system under analysis and the threat assessment process. Rather than directly applying extensive rule sets to the complex system, the patent uses the data flow graph as a mediator that simplifies the system representation. The threat list then operates on this simplified intermediate representation, reducing the complexity of the overall analysis process while maintaining detection effectiveness.
Data Source
AI summary
An analysis condition for security risk for a data flow in a system to be analyzed is automatically generated. An analysis condition generating apparatus 1A generates from a natural sentence, using ontology in which a relationship is described between one or more nodes on a data flow graph that indicates a data flow in a system to be analyzed and one or more edges that indicate an event related to the nodes, graph structural data indicating the relationship between the nodes and the edges, and generates an analysis condition for analyzing security risk for the system to be analyzed based on the graph structural data.