Scan Quality Index for Software Security Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Commercial software security scanning engines often generate results regardless of input quality, leading to low-quality scans due to factors like missing dependencies, outdated language support, and manual review requirements of verbose log files, which can result in missed vulnerabilities.
Innovation Solution
Implementing a scan quality index engine that analyzes log files and configuration data to provide a confidence score for scan results, preventing releases when scores are below a predetermined value, and weighting scores based on executable lines of code and known security problem types.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If commercial scanning engines generate results regardless of input quality, then scan coverage is maintained, but scan quality and reliability deteriorate
Solution Approach 1:
The patent introduces a scan quality index as an intermediary metric between the scanning engine and the release decision. This index evaluates multiple factors (log file quality, configuration completeness, dependency availability) to provide a confidence score that mediates between maintaining scan coverage and ensuring scan quality. The index acts as a filter that prevents low-quality scans from being accepted as valid results.
Solution Approach 2:
The patent changes the parameter of scan evaluation from a binary pass/fail result to a continuous quality index score. By introducing multiple measurable parameters (log file completeness, configuration validity, dependency resolution status), the system transforms the quality assessment into a multi-dimensional parameter space that can be objectively measured and improved.
2Measurement precision
If verbose log files are manually reviewed to verify scan quality, then measurement precision improves, but loss of time increases
Solution Approach 1:
The scan quality index engine performs self-service by automatically evaluating its own scan results without requiring manual reviewer intervention. The system autonomously analyzes log files, checks configuration completeness, verifies dependency resolution, and generates a quality score, thereby eliminating the time-consuming manual review process while maintaining measurement precision.
Solution Approach 2:
The patent implements a feedback mechanism where the scan quality index provides immediate automated evaluation of scan results. This feedback loop allows the system to quickly identify low-quality scans and trigger re-scans or alerts, eliminating the need for slow manual review processes while maintaining high measurement precision through automated validation.
3Reliability
If scanning is performed without checking dependencies and configuration quality, then productivity is maintained, but scan quality deteriorates
Solution Approach 1:
The patent applies preliminary action by checking dependencies and configuration quality before executing the main scanning process. The scan quality index evaluates prerequisite conditions (available dependencies, valid configurations, complete log files) in advance, ensuring that only scans meeting quality thresholds are performed. This prevents wasted scanning efforts on inadequate inputs while maintaining manageable process complexity through structured pre-checks.
Data Source
AI summary
In one embodiment, a method for software security scanning employing a scan quality index may include (1) a server comprising at least one computer processor receiving an identification of a computer program for security scanning; (2) the server executing a security scan on the computer program resulting in at least one log file comprising results of the security scan; (3) the server executing a scan quality index tool that analyzes the at least one log file resulting in a scan quality index score; and (4) the server outputting the scan quality index score.