Script Security Analysis via Execution Graph Vectorization

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Automated scripts, used to test software code and systems, often bypass security protocols and can pose security threats when executed internally, making it difficult to detect and prevent potential vulnerabilities, especially since their execution is typically unmonitored.

Innovation Solution

A graph-based approach is used to analyze automated scripts by breaking them down into component steps, generating a graph, converting it into a vector, and comparing it with clusters of other vectors to determine a security score, which prevents the script from executing if the score exceeds a threshold.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If automated scripts are executed internally to test software code and systems, then productivity and automation are improved, but security threats and vulnerabilities increase because scripts bypass typical security protocols

Engineering Contradiction:

Improveautomation of software testingVSAvoidsecurity threats from internal script execution

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The system performs preliminary analysis of automated scripts before execution by parsing them into an abstract syntax tree and generating execution graphs. This preliminary action identifies potential security threats in advance, allowing the system to prevent harmful script execution before it occurs, thus resolving the contradiction between enabling automation and preventing security risks

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The invention introduces an intermediary security analysis layer between script generation and execution. This intermediary component includes a parser that converts scripts into abstract syntax trees and a graph generator that creates execution graphs, which are then evaluated by a security analyzer. This intermediary structure allows automated scripts to be tested and validated before execution, enabling both productivity and security

Inventive Principle:

Principle #24Intermediary (Mediator)

2Productivity

If automated scripts are executed unmonitored overnight, then productivity is maintained without interruption, but detection of security threats becomes difficult

Engineering Contradiction:

Improvecontinuous software testingVSAvoiddetection of security threats in unmonitored execution

Core Design Contradiction:

ProductivityVSDifficulty of detecting and measuring

Solution Approach 1:

The system performs all security analysis actions before script execution, including parsing into abstract syntax trees, generating execution graphs, and evaluating against security rules. This preliminary action ensures that even unmonitored overnight executions are pre-vetted for security threats, maintaining both continuous productivity and security detection capability

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The security analyzer provides feedback by comparing generated execution graphs against a database of known malicious patterns and security rules. This feedback mechanism enables the system to detect and block harmful scripts before execution, ensuring that unmonitored overnight runs remain secure while maintaining productivity

Inventive Principle:

Principle #23Feedback

3Object-affected harmful factors

If security protocols are applied to internal script execution, then security is improved, but device complexity increases due to additional monitoring and validation layers

Engineering Contradiction:

Improvesecurity protection for internal scriptsVSAvoidcomplexity of script analysis system

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The security analysis system is segmented into distinct functional modules: a parser that converts scripts to abstract syntax trees, a graph generator that creates execution graphs, and a security analyzer that evaluates graphs against security rules. This segmentation allows each component to be optimized independently and simplifies the overall system architecture while maintaining comprehensive security protection

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The invention uses an intermediary representation (execution graph) that bridges the script and security analysis domains. This intermediate structure standardizes the representation of script operations, making security analysis more systematic and manageable. The graph-based approach provides a structured way to handle complexity by breaking down script analysis into standardized graph generation and evaluation steps

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11290481B2Security threat detection by converting scripts using validation graphs

Publication Date: 2022.03.29 BANK OF AMERICA CORP

AI summary

A tool uses a graph-based approach to analyze scripts to determine whether the scripts pose security threats when executed. The tool breaks down scripts into component steps and generates a graph based on those steps. The tool then converts the graph into a vector and compares that vector with clusters of other vectors. Based on that comparison, the tool determines whether the script will cause a security vulnerability. If the script causes a security threat when executed, the script may be prevented from executing.