Application Security Threat Detection Using Quartile Weighted Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information security control technologies are not configured to provide a reliable and efficient solution for detecting and mitigating application security threats in a continuous integration/continuous deployment (CI/CD) pipeline process.
Innovation Solution
A system that integrates distinct security models, including static and run-time security models, to analyze development code sets, detect threat objects, and dynamically trigger development security models based on threat threshold ratios and false positive ratios, using quartile weights to adjust threat object measurements and improve detection accuracy and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional security control technologies are used to analyze development code sets, then security analysis can be performed, but the solution is not reliable and efficient for detecting and mitigating application security threats in CI/CD pipeline
Solution Approach 1:
The system segments security analysis into multiple distinct security models (static security model, run-time security model, development security model) that operate at different stages of the CI/CD pipeline. Each model handles specific aspects of security analysis, improving both reliability through specialized analysis and efficiency by avoiding redundant full-scale analysis at every stage.
Solution Approach 2:
The static security model performs preliminary security analysis on development code sets before they are combined and deployed. By detecting and flagging potential threat objects in advance, the system prevents many security issues from reaching production, improving reliability while reducing the burden on runtime security mechanisms.
2Measurement precision
If multiple distinct security models are executed to analyze development code sets, then detection accuracy improves, but processing time and computational resources increase
Solution Approach 1:
The system dynamically adjusts which security models are executed and how thoroughly they analyze code based on the detected threat levels and false positive measurements. When threat levels are low and false positive rates are high, the system reduces analysis intensity to save time. When threats are detected, it intensifies analysis to ensure accuracy, thus balancing precision and time loss adaptively.
Solution Approach 2:
The system uses feedback from run-time security model measurements (threat object measurements and false positive measurements) to adjust the behavior of static and development security models. This feedback loop allows the system to optimize its analysis depth and model selection based on actual performance data, improving detection accuracy while minimizing unnecessary processing time.
3Reliability
If static security model analyzes each development code set to detect threat objects, then security threats can be identified, but false positive detections increase processing overhead
Solution Approach 1:
The system changes parameters such as threat thresholds and analysis depth based on measurements from run-time security modeling. By adjusting these parameters dynamically, the system can reduce false positives and optimize resource usage while maintaining reliable threat identification. For example, when false positive rates are high, the system can increase thresholds to filter out spurious detections.
4Speed
If run-time security model analyzes combined development code sets, then real-time threat detection is achieved, but memory and processing resources are consumed
Solution Approach 1:
The system applies partial analysis at runtime by focusing security monitoring on specific high-risk areas or recently changed code portions rather than analyzing the entire code base continuously. This selective approach maintains real-time detection capability while significantly reducing overall resource consumption compared to exhaustive runtime analysis of all code.
Data Source
AI summary
A system for detecting and mitigating application security threats comprises a processor associated with a server. The processor analyzes a group of code sets of an application and determines a number of the threat objects in each code set. The processor further executes a run-time security model to analyze a combined code sets to determine threat object measurements and false positive measurements of application product releases for the application. The processor determines threat threshold ratios and false positive ratios per application. The processor further generates an array of quartile weights corresponding to a set of quartile ranges of the threat threshold ratios and a set of quartile ranges of the false positive ratios associated with the application. The processor generates an adjusted object measurement for the application based on a corresponding quartile weight in the array. The processor determines whether to trigger a development security model for the application.