Multiple Sequence Alignment for Static Analysis Trace Simplification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static analysis tools generate numerous security vulnerability findings that are difficult to consume due to multiple traces containing common nodes, leading to prioritization challenges for investigation and mitigation.
Innovation Solution
Applying multiple sequence alignment to simplify code traces and using a compression function to reduce the size of alignment results and visualize call graphs, enabling users to identify critical security vulnerabilities more effectively.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple traces are generated to capture all code execution paths, then security vulnerability detection completeness is improved, but the number of findings increases making them difficult to consume
Solution Approach 1:
The patent merges multiple similar traces into a single representative trace by identifying common nodes and paths. Traces that share substantial commonality are consolidated, with the common portion represented once and variations noted, thereby reducing the total number of findings while preserving security vulnerability detection completeness.
Solution Approach 2:
The patent extracts and separates the common portions from variable portions of traces. By identifying and extracting common nodes and paths, the system can represent multiple traces more efficiently, removing redundancy while maintaining the essential security information needed for vulnerability detection.
2Loss of information
If all trace details are presented to provide complete information, then information completeness is improved, but the complexity and size of the data increases
Solution Approach 1:
The patent applies different levels of detail to different portions of the trace data. Common nodes are represented at a summarized level, while only the variable or critical portions are detailed explicitly. This local quality approach maintains information completeness for security-relevant details while reducing overall data complexity.
3Ease of operation
If traces are simplified to reduce complexity, then ease of consumption is improved, but the ability to distinguish between similar paths decreases
Solution Approach 1:
The patent segments traces into common and variable portions. By dividing the trace data this way, the system can simplify the common portions for ease of consumption while preserving and highlighting the variable portions that distinguish between different paths, maintaining path distinction accuracy where it matters most.
Data Source
AI summary
A static analysis tool is augmented to provide for enhanced security vulnerability determination from generated code traces. According to this disclosure, a multiple sequence alignment is applied to a set of traces generated by static analysis of application source code. The output of this operation is an alignment result that simplifies the traces, e.g., by representing many common nodes as a single node. In particular, the sequence alignment identifies entries in the alignment result that represent at least one code execution path that multiple traces in the set of traces include. A call graph can then be output that includes the at least one code execution path identified, and that call graph can also be simplified by applying a compression portions of the traces that are used to generate it. Using multiple sequence alignment and simplified call graphs enable a user to identify security vulnerabilities more efficiently.