Software Image Exploitability Analysis in Target Runtime Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods fail to determine whether vulnerabilities in software images can be exploited in the specific runtime environment of a target device, leading to potential security gaps.
Innovation Solution
A method to analyze the exploitability of vulnerabilities by identifying software components, determining associated exploits, and executing them on the target computer's specific runtime environment, creating a modified, non-exploitable software image based on policy and confirmed vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If vulnerabilities are identified in software images using static analysis, then vulnerability detection is improved, but it cannot determine whether the vulnerabilities are actually exploitable in the specific runtime environment
Solution Approach 1:
The patent applies preliminary action by executing exploits against the software image in a controlled runtime environment before deployment to actual target devices. This preliminary testing phase confirms whether identified vulnerabilities are actually exploitable in the specific runtime environment, preventing false positives and ensuring reliable security assessment.
Solution Approach 2:
The patent introduces a runtime environment configuration as an intermediary between the software image and the exploit execution. This intermediary layer allows systematic testing of vulnerabilities in a controlled setting that mirrors the actual deployment environment, enabling accurate determination of exploitability without directly exposing real systems.
2Reliability
If all identified vulnerabilities are addressed, then security coverage is improved, but time and resources are consumed analyzing and remediating non-exploitable vulnerabilities
Solution Approach 1:
The patent extracts and separates exploitable vulnerabilities from non-exploitable ones through systematic testing in the runtime environment. By taking out only the truly exploitable vulnerabilities for remediation, the process eliminates wasted time and resources spent on addressing vulnerabilities that cannot be exploited in the specific runtime configuration.
Solution Approach 2:
The patent applies partial action by focusing remediation efforts only on the subset of vulnerabilities that are confirmed as exploitable, rather than addressing all identified vulnerabilities. This selective approach optimizes resource utilization by concentrating efforts on the critical few vulnerabilities that pose actual security risks.
3Reliability
If software images are updated frequently to address vulnerabilities, then security is improved, but system stability and operational continuity are affected
Solution Approach 1:
The patent implements feedback by systematically testing exploits against the software image in the runtime environment before deployment. This feedback mechanism ensures that only vulnerabilities confirmed as exploitable trigger updates, preventing unnecessary system reboots and stability disruptions while maintaining security through targeted, verified remediations.
Data Source
Figure 1~2
Figure 3
AI summary
The invention relates to a method for automatically analysing the exploitability of vulnerabilities of a software image (12, 23) executed on a target computer (31), comprising: - identifying (S1) all the software components contained in the software image, - determining (S2) vulnerabilities of the identified software component for each software component of the software image (12, 23) using a vulnerability database (14, 25), - determining (S3) all exploits associated with the at least one determined vulnerability of the software component, for each identified software component, using an exploit database (15, 26), - associating (S4) the determined exploits with the software image (12, 23), and - executing (S5) the software image (12, 23) and the exploit associated with the software image (12, 23) on a configuration of an execution environment specific to the target computer (31), and - confirming (S6) the exploitability of the at least one identified vulnerability on the specific configuration of the execution environment (31) if the execution of the at least one exploit leads to exploitation of the vulnerability.