PCA-Based Password Hardcoding Detection Reducing False Alarms
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current password hard-coding detection methods, such as those using Fortify scanning tools, suffer from high false alarm rates, significantly reducing developer efficiency and auditing speed due to the need for manual verification of detected issues.
Innovation Solution
A PCA-based method that collects and analyzes feature values from function code blocks to construct a model for distinguishing between actual and false password hard-coding alarms, utilizing data such as code length, return types, and keyword presence to reduce false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If Fortify scanning tool is used for password hard-coding detection, then security risk is identified, but false alarm rate increases significantly
Solution Approach 1:
The patent introduces an intermediary verification mechanism that sits between the Fortify scanner and the final security assessment. When Fortify detects a potential hard-coded password, the system extracts contextual features (surrounding code, function signatures, comments) and uses these as intermediaries to verify whether the detection is a true security issue or a false alarm, thereby reducing false positives while maintaining security identification capability
Solution Approach 2:
The patent changes the detection parameters from simple keyword matching to multi-dimensional feature analysis. Instead of relying solely on Fortify's default scanning parameters, the system extracts multiple parameters including code context features, function signature features, and comment features, then combines these parameters to make more accurate security assessments, reducing false alarms while maintaining detection reliability
2Measurement precision
If manual verification is performed for each scanned problem, then detection accuracy improves, but developer efficiency decreases
Solution Approach 1:
The patent implements a self-service verification system where the code itself provides the verification evidence. By extracting contextual features from the code (surrounding statements, function signatures, comments), the system enables the code to verify its own security status without requiring external manual intervention. This automated self-verification maintains high detection accuracy while preserving developer productivity
Solution Approach 2:
The patent applies partial verification action by not requiring full manual review of all detected issues. Instead, it performs automated feature extraction and analysis on relevant portions of the code (contextual features around detected passwords), applying verification only where necessary based on detection confidence levels, thus maintaining accuracy without requiring exhaustive manual checking of every alert
3Reliability
If comprehensive code auditing is performed for each project, then security quality improves, but auditing time increases
Solution Approach 1:
The patent performs preliminary feature extraction and analysis during the initial scanning phase. By extracting contextual features, function signatures, and comment information upfront before the actual security assessment, the system prepares verification evidence in advance. This preliminary action enables faster security quality assessment during auditing without requiring time-consuming manual analysis of each code segment
Solution Approach 2:
The patent extracts essential verification features from the comprehensive code base before performing security auditing. By taking out and isolating key features (contextual code snippets, function signatures, security-related comments) from the entire project, the system enables efficient security quality assessment without requiring reviewers to analyze every line of code, thus maintaining high security standards while reducing auditing time
Data Source
AI summary
A password hardcoding checking method and apparatus based on PCA, and a medium. the checking method includes: step one, data collection, involving: collecting function code blocks in which data of password hardcoding that is subject to a false alarm is located; step two, extracting feature values in the function code blocks collected in step one, so as to obtain a feature set; step three, using the function code blocks collected in step one to serve as samples to construct a PCA model; and step four, on the basis of the PCA model constructed in step three and the feature set obtained in step two, detecting whether there is a false alarm in password hardcoding. by means of the method, the false alarm rate of hardcoding checking in code scanning is reduced, and the working efficiency of a developer and a code auditor is improved.