Runtime Dependency Mapping for Vulnerability Remediation Prioritization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Without access to source code, it is difficult to determine the dependencies of a program and assess the downstream effects of replacing a vulnerable library, making it challenging to effectively remediate vulnerabilities.

Innovation Solution

A system and method to generate a dependency tree at runtime using program information, enrich it with frequency data, and detect vulnerabilities, recommending optimal remediations based on the enriched tree.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Loss of information

If source code analysis is used to create dependency trees, then complete dependency information can be obtained, but source code must be accessible which is not always available at runtime

Engineering Contradiction:

Improvedependency informationVSAvoidaccess to source code

Core Design Contradiction:

Loss of informationVSEase of operation

Solution Approach 1:

Instead of analyzing source code to determine dependencies (traditional approach), the patent inverts the approach by observing runtime behavior to infer dependencies. The system monitors function calls, library loads, and execution patterns during program runtime to dynamically construct the dependency tree, eliminating the need for source code access.

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The patent introduces runtime observation mechanisms as intermediaries between the program execution and dependency analysis. By inserting monitoring agents that track library loads, function calls, and execution flows during runtime, the system indirectly captures dependency information without requiring direct access to source code.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If vulnerable libraries are replaced to remediate vulnerabilities, then security is improved, but downstream effects on other libraries may be unknown without dependency information

Engineering Contradiction:

ImprovesecurityVSAvoiddownstream effects information

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The patent applies preliminary action by constructing the dependency tree before vulnerability remediation takes place. By dynamically analyzing runtime behavior to map out all dependencies upfront, the system identifies which libraries will be affected by replacing a vulnerable library, enabling informed remediation decisions that prevent breaking downstream functionality.

Inventive Principle:

Principle #10Preliminary action

3Reliability

If all vulnerabilities are addressed, then security is maximized, but the effort and complexity of remediation increases significantly

Engineering Contradiction:

ImprovesecurityVSAvoidremediation complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies local quality by prioritizing vulnerability remediation based on local impact analysis. Instead of treating all vulnerabilities equally, the system uses the dynamically constructed dependency tree to identify which vulnerabilities have the most significant downstream effects and should be addressed first, allowing selective remediation that balances security improvement with remediation complexity.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS20260017382A1Vulnerability Detection And Smart Remediation Using Runtime Data

Publication Date: 2026.01.15 DATADOG INC

AI summary

The present disclosure describes a system and method for generating a dependency tree for program information collected at runtime, and enriching the dependency tree with information relating to how frequently functions are called at runtime. The present disclosure further provides for detecting vulnerabilities in functions, and generating recommendations for an optimal remediation that efficiently addresses one or more vulnerabilities. Either or both of the vulnerabilities and the remediations may be sorted and ranked, such that the most critical vulnerabilities are identified and the most effective remediations are identified.