Reachability Graph for Static Taint Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Manual code inspection for identifying user input vulnerabilities is time-consuming and inefficient, as it requires checking large amounts of software code for potential exploitation through data dependencies.
Innovation Solution
A method and system for detecting user input dependence in software code using a reachability graph and Augmented Static Single Assignment (aSSA) form, which tracks both control and data dependencies to identify tainted code, reducing the manual inspection burden by representing software code with nodes and directed edges to mark user input-dependent sections.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual code inspection is used to identify user input vulnerabilities, then detection precision is improved, but time consumption increases significantly
Solution Approach 1:
The patent creates a reachability graph that is a simplified representation (copy) of the software code's control flow and data dependency structure. This graph model allows automated analysis to quickly identify tainted code paths without manually inspecting the entire codebase, thus reducing time consumption while maintaining detection precision through systematic traversal of the graph structure
Solution Approach 2:
The patent extracts only the essential information needed for vulnerability detection - the control flow edges and data dependency relationships - and represents them as a reachability graph. By taking out only the critical structural elements and eliminating redundant code details, the system enables fast automated analysis while preserving the precision needed to identify user input vulnerabilities
2Productivity
If static program analysis is used to track data dependencies, then productivity is improved, but device complexity increases
Solution Approach 1:
The patent segments the complex software code into discrete nodes representing basic blocks or statements, and represents data dependencies as directed edges between these nodes. This segmentation transforms the complex code structure into a manageable graph representation that can be systematically traversed by automated tools, improving productivity while keeping the analysis mechanism itself relatively simple
Solution Approach 2:
The reachability graph serves as an intermediary representation between the original complex code and the analysis process. Instead of directly analyzing the full codebase complexity, the system uses this intermediate graph structure to track data dependencies and identify tainted paths, thereby improving productivity without requiring the analysis tool to handle the full complexity of the original code
3Ease of operation
If reachability graph traversal is used to identify tainted code, then ease of operation is improved, but measurement precision may be reduced
Solution Approach 1:
The patent performs preliminary actions by pre-processing the code to construct the reachability graph with all control flow edges and data dependency edges before actual vulnerability analysis. This pre-construction of the graph structure with proper edge labeling (control dependency vs. data dependency) enables simple and accurate traversal during analysis, improving ease of operation while maintaining measurement precision through the carefully built graph representation
Data Source
AI summary
A method for detecting user input dependence in software code. The method including representing the software code with a reachability graph having: a plurality of nodes, where a root node of the plurality of nodes represents an input controlled by a user; a first directed edge connecting a first node of the plurality of nodes and a second node of the plurality of nodes, where the first directed edge represents a data dependency; and a second directed edge connecting a third node of the plurality of nodes and a fourth node of the plurality of nodes, wherein the second directed edge represents a data dependency. The method also includes identifying a fifth node of the plurality of nodes as a reachable node from the root node by traversing the reachability graph from the root node to the reachable node; and marking a portion of the software code represented by the reachable node as user input dependant.