Software Flaw Identification via Application-Configuration Interaction Analysis

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing software-system testing methods struggle to accurately and precisely identify flaws in software systems, particularly when configuration and application code interactions are complex.

Innovation Solution

A system and method that analyze both the application subsystem and the configuration subsystem of a software system to identify flaws resulting from the combination of operations and configurations, using data structures such as data-flow graphs and JSON/XML configurations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If existing software-system testing methods are used to identify flaws, then the testing process can be performed, but the identification of flaws is inaccurate and imprecise

Engineering Contradiction:
Improveflaw identification accuracyVSAvoidflaw identification reliability
Core Design Contradiction:
Measurement precisionVSReliability

Solution Approach 1:

The patent combines the analysis of application code and configuration code into a unified flaw identification process. The system merges two separate codebases (application and configuration) and analyzes their interactions to identify flaws, rather than analyzing them separately. This integration allows the system to detect flaws that arise from the combination of operations defined in application code and configurations defined in configuration code, thereby improving both accuracy and reliability of flaw identification.

Inventive Principle:
Principle #5Merging (Combining)

2Device complexity

If configuration code and application code are analyzed separately, then the analysis process is simpler, but flaws resulting from their combination are missed

Engineering Contradiction:
Improveanalysis process complexityVSAvoidflaw identification precision
Core Design Contradiction:
Device complexityVSMeasurement precision

Solution Approach 1:

The system merges the analysis of configuration code and application code by creating a unified data structure that represents both codebases and their interactions. The processor analyzes the combined code to identify flaws that result from the interaction between configuration definitions and application operations, ensuring that combination-induced flaws are detected while managing complexity through systematic integration.

Inventive Principle:
Principle #5Merging (Combining)

3Measurement precision

If a comprehensive analysis of both application and configuration subsystems is performed, then flaw identification accuracy improves, but the analysis time and computational resources increase

Engineering Contradiction:
Improveflaw identification accuracyVSAvoidanalysis time
Core Design Contradiction:
Measurement precisionVSLoss of time

Solution Approach 1:

The system extracts only the essential elements needed for flaw identification from the comprehensive codebase. Instead of analyzing every aspect of both application and configuration code, the system extracts operations from application code and configurations from configuration code, then focuses analysis specifically on their interactions. This extraction approach maintains high accuracy in flaw identification while reducing unnecessary analysis time and computational overhead.

Inventive Principle:
Principle #2Taking out (Extraction)

Data Source

PatentEP3961445B1Automatic identification of flaws in software systems
Publication Date: 2025.05.07 CHECKMARX LTD
  • EP3961445B1 patent drawingFigure 1
  • EP3961445B1 patent drawingFigure 2
  • EP3961445B1 patent drawingFigure 3A

AI summary

A system (20) includes an output device (26, 28, 34) and a processor (24). The processor is configured to analyze a software system (50), which includes an application subsystem (52) and a configuration subsystem (53), so as to generate an output (27, 29) describing (i) one or more operations performed by the application subsystem, and (ii) one or more configurations for the application subsystem, which are provided by the configuration subsystem. The processor is further configured to identify, based on the output, at least one flaw in the software system that results from a combination of the operations with the configurations, and to output via the output device, in response to identifying the flaw, an indication of the flaw. Other embodiments are also described.