Context-Aware Sensitive Data Detection via Semantic Scanning Rules
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current static code analysis tools are unable to understand the context and semantics of applications, leading to ineffective detection of sensitive data usage violations and compliance with privacy laws, as they cannot determine if retrieved data contains sensitive information or identify its type.
Innovation Solution
Generating semantically relevant scanning rules from structured and unstructured data analysis, which are used to scan code and identify potential violations, providing context and semantics to the source code analyzer or runtime analyzer, enabling the detection of sensitive information in various data formats and sources like databases.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Difficulty of detecting and measuring
If static code analysis is used to scan code for sensitive data, then the scanning capability is provided, but the ability to understand context and semantics of the application is lost
Solution Approach 1:
The patent introduces a data flow analysis component as an intermediary between static code analysis and sensitive data detection. This intermediary tracks the flow of data through the application, maintaining context information about data origins and transformations, thereby enabling semantic understanding without sacrificing detection capability
Solution Approach 2:
The patent implements a multi-layered analysis architecture where static code analysis is nested within data flow analysis, which is itself nested within a broader context-aware evaluation framework. Each layer operates on different levels of abstraction, with inner layers providing detailed detection and outer layers providing contextual understanding
2Measurement precision
If hardcoded values are scanned for sensitive information, then direct sensitive data can be identified, but retrieved data from storage mechanisms cannot be identified as sensitive
Solution Approach 1:
The patent implements continuous data flow tracking that follows sensitive data from storage mechanisms through processing operations to output points. This continuous monitoring enables the system to identify sensitive data regardless of its source, maintaining detection precision while adapting to different data access patterns
Solution Approach 2:
The patent employs feedback mechanisms where data flow analysis results feed back into the scanning process, allowing the system to learn from identified sensitive data patterns and improve detection of retrieved data. The feedback loop enables the system to adapt to different data sources and access methods while maintaining identification precision
3Area of stationary object
If comprehensive scanning rules are applied to all data, then complete coverage is achieved, but false positives increase and compliance accuracy decreases
Solution Approach 1:
The patent applies different scanning rules and sensitivity levels to different regions of the codebase based on data flow analysis. High-risk areas with direct sensitive data handling receive comprehensive scanning, while lower-risk areas use streamlined rules, optimizing both coverage and accuracy by matching scanning intensity to local context
Data Source
AI summary
Testing software applications often requires a balancing of thoroughness versus the time and computing resources available to perform such tests. Certain data handling operations may potentially expose data to unauthorized parties. However, not all data is equal; some data requires a greater degree of protection than other data, which may be based on a security context (e.g., rule, law, policy, etc.). By generating rules determined by a particular context, extraneous tests on data outside of the context, may be omitted. Unnecessary tests may be omitted and the results of each analysis process correlated to identify actual vulnerabilities and omit false positives, such as vulnerabilities to data that does not require the same degree of care to avoid unauthorized exposure.