Automated Patch Verification for Source Code Vulnerabilities

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Application developers face challenges in manually identifying vulnerabilities and determining if included open sources are patched within large-scale source code, as existing methods lack automation for verifying the patched status of open sources.

Innovation Solution

An electronic device and method that compare character strings from a patch file with the source code, providing information on whether the source code has been patched, the probability of being patched, or details about vulnerabilities, using a processor to classify and generate a comparison file for automated analysis.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If manual identification of vulnerabilities is performed in large-scale source code, then developers can identify vulnerabilities, but the process becomes time-consuming and inefficient

Engineering Contradiction:

Improvevulnerability identification accuracyVSAvoidtime for vulnerability identification

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent replaces the manual mechanical process of vulnerability identification with an automated electronic system. The processor automatically compares source code against vulnerability databases and patch files, eliminating the need for manual code review while maintaining high accuracy in identifying vulnerabilities and determining patched status.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system enables self-service vulnerability detection by automatically comparing source code with known vulnerability patterns and patch information. The electronic device independently performs the entire vulnerability assessment process without requiring developer intervention, thus reducing time loss while maintaining identification accuracy.

Inventive Principle:

Principle #25Self-service

2Productivity

If automated vulnerability scanning is implemented, then time efficiency is improved, but the ability to accurately determine patched status of open sources becomes challenging

Engineering Contradiction:

Improvevulnerability detection speedVSAvoidpatched status verification accuracy

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The system performs preliminary actions by pre-processing patch files and extracting key vulnerability indicators before the actual comparison. The processor prepares reference data from patch files in advance, which enables rapid automated scanning while maintaining the ability to accurately verify patched status through pre-established comparison criteria.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The vulnerability detection process is segmented into distinct phases: extracting vulnerability information from patch files, comparing source code against vulnerability patterns, and separately determining patched status. This segmentation allows automated high-speed processing while maintaining precision in patched status verification through dedicated comparison steps.

Inventive Principle:

Principle #1Segmentation

3Reliability

If comprehensive vulnerability analysis is performed on all open sources, then security is improved, but the complexity of the detection system increases

Engineering Contradiction:

Improvesoftware securityVSAvoiddetection system complexity

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The system extracts only the essential vulnerability indicators and patched status markers from patch files, rather than analyzing entire patch contents. This extraction approach enables comprehensive security analysis of all open sources while reducing system complexity by focusing only on critical comparison points.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The system performs partial analysis by comparing only specific vulnerability-related portions of source code against patch information, rather than analyzing entire codebases. This partial action approach maintains high security reliability by targeting critical vulnerability areas while avoiding the complexity of comprehensive code analysis.

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11861014B2Electronic device detecting software vulnerability and method for operating same

Publication Date: 2024.01.02 SAMSUNG ELECTRONICS CO LTD

AI summary

According to one or more embodiments, an electronic device comprises: a display device; a memory for storing at least one source code and a comparison file including any one of a modification and a vulnerability, in which each of at least one character string included in a patch file corresponding to the at least one source code is classified; and a processor functionally connected to the memory and the display device, wherein the processor can be set to load the at least one source code stored in the memory, compare a character string included in the comparison file corresponding to the at least one source code with a character string included in the source code, and provide, through an output device, at least one piece of information from among pieces of information about whether the identified source code is patched, the probability that the source code is patched, and a vulnerability in the source code, on the basis of the result of the comparison.