Software Attack Surface Metric Computation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Determining the security and vulnerability of software deployments is challenging due to their complex interactions with user environments, communication networks, and storage, making it difficult to identify which deployment is more secure and less vulnerable to attacks.

Innovation Solution

A system is developed to generate a platform for testing software deployments, identifying protocols, performing static analysis, and calculating metrics such as unused ports, open ports, traffic volume, choke points, and protocol danger scores to determine an attack surface, allowing for comparison and visualization of different deployment vulnerabilities.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If software applications are deployed with multiple parameters and customizations to meet different user needs, then adaptability and versatility are improved, but device complexity increases and security assessment becomes more difficult

Engineering Contradiction:
Improvedeployment flexibilityVSAvoidsecurity assessment complexity
Core Design Contradiction:
Adaptability or versatilityVSDevice complexity

Solution Approach 1:

The system changes parameters by computing multiple metrics (attack surface, vulnerability score, security posture) that quantify different aspects of software deployment security. These metrics transform complex security characteristics into comparable numerical values, allowing assessment of deployments with varying parameters and customizations without manually analyzing each configuration's security implications

Inventive Principle:
Principle #35Parameter changes

Solution Approach 2:

The patent replaces manual security assessment methods with automated computational analysis. Instead of manually reviewing code and configurations to evaluate security, the system uses automated metric computation including static analysis, dynamic analysis, and comparison against known vulnerability databases, substituting human expert analysis with systematic computational procedures

Inventive Principle:
Principle #28Mechanics substitution (Replace mechanical system)

2Reliability

If comprehensive security analysis is performed on software code to identify vulnerabilities, then reliability is improved, but difficulty of detecting and measuring increases due to complex interactions with environment

Engineering Contradiction:
Improvesecurity reliabilityVSAvoidvulnerability detection difficulty
Core Design Contradiction:
ReliabilityVSDifficulty of detecting and measuring

Solution Approach 1:

The system segments security analysis into distinct metric computations: attack surface metric (identifying entry points), vulnerability score (assessing known vulnerabilities), and security posture metric (overall security evaluation). Each metric addresses a specific aspect of security, breaking down the complex task of comprehensive security analysis into manageable, measurable components that can be computed and compared independently

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The patent introduces intermediary metrics as mediators between the complex software environment and security assessment. Rather than directly analyzing complex code-environment interactions, the system computes intermediate values (attack surface, vulnerability scores) that bridge the gap between raw software configurations and security conclusions, making the detection and measurement process more tractable

Inventive Principle:
Principle #24Intermediary (Mediator)

Data Source

PatentEP3013016B1Determining an attack surface of software
Publication Date: 2020.02.12 FUJITSU LTD
  • EP3013016B1 patent drawingFigure 1A
  • EP3013016B1 patent drawingFigure 1B
  • EP3013016B1 patent drawingFigure 2

AI summary

A method of determining an attack surface of software may include generating a platform for testing at least one deployment of software code, identifying protocols that are used by the at least one deployment, mapping the protocols to at least one port in the at least one deployment, and computing a metric comprising parameters for the at least one deployment.