Software Verification Guidance Engine for Early Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software verification approaches focus primarily on testing, which occurs late in the development cycle, making it impractical to correct security vulnerabilities without rewriting significant code and often provide inadequate guidance to developers, leading to ineffective fixes or new issues.
Innovation Solution
A system that integrates software verification tools into the development environment, allowing for real-time analysis and feedback, linking identified problems to targeted training modules, and presenting results incrementally to facilitate optimal solution implementation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If software verification is performed through traditional testing methods, then security vulnerabilities can be detected, but the detection occurs late in the development cycle requiring extensive code rewriting
Solution Approach 1:
The patent applies preliminary action by performing static analysis and model checking during the development phase rather than through traditional post-development testing. The system analyzes software code, generates execution models, and verifies security properties before the software is deployed, enabling early detection of vulnerabilities without requiring extensive code rewriting later.
Solution Approach 2:
The patent segments the verification process into distinct phases: code analysis to extract variables and statements, execution model generation from the code, and model checking to verify security properties. This segmentation allows each phase to be optimized independently and enables incremental verification throughout development.
2Reliability
If comprehensive security analysis is performed on software code, then security vulnerabilities can be identified, but the complexity of the analysis system increases
Solution Approach 1:
The patent introduces an execution model as an intermediary between the software code and the model checking process. The system first generates an execution model from the code, which captures the software's behavior in a simplified form, and then performs model checking on this intermediate representation rather than directly on the complex source code, reducing analysis system complexity.
Solution Approach 2:
The patent creates a simplified copy or representation of the software system through execution models. Instead of analyzing the full complexity of the original code directly, the system works with a copied abstract representation that preserves essential security-relevant behaviors while eliminating unnecessary complexity.
3Ease of operation
If security verification is integrated into the development environment, then real-time feedback can be provided to developers, but the processing load on the system increases
Solution Approach 1:
The patent applies partial action by performing model checking on selected security properties and critical code paths rather than exhaustively analyzing every aspect of the software. The system identifies and verifies only the most relevant security properties, reducing processing load while still providing effective real-time feedback to developers.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Disclosed herein are methods, systems, and computer program products directed to a guidance engine. The guidance engine is configured to query a knowledge base for guidance with respect to a property of a software application. The guidance engine receives a responsive query from the knowledge base that is based on the property. The responsive query informs a user of the guidance engine how to address a vulnerability within the software application by performing a transform with respect to a property of the software application.