Source Code Risk Evaluation Apparatus
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The integration of open source libraries into application programs often leads to unnoticed vulnerabilities due to inadequate post-introduction verification, as the complexity of library dependencies and changing usage modes within the application program result in unappreciated risks that are not appropriately evaluated over time.
Innovation Solution
An evaluation apparatus and method that generates and calculates a risk value for libraries within a source code, based on static and dynamic evaluations, and outputs time-series data to visualize and monitor the evolving risk, enabling continuous assessment of library vulnerabilities and their impact on the application program.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If open source libraries are incorporated into application programs to enhance functionality, then the adaptability and versatility of the application program is improved, but the reliability and security of the system deteriorate due to unnoticed vulnerabilities and inadequate post-introduction verification
Solution Approach 1:
The patent performs static analysis on library source codes before incorporation to detect vulnerabilities in advance. The analysis includes checking for security holes, bugs, and other risk factors in the library code prior to integrating it into the application program, thereby preventing vulnerable libraries from being introduced.
Solution Approach 2:
The patent implements continuous monitoring and dynamic analysis after library incorporation to detect changes in vulnerability status. The system periodically re-evaluates libraries and provides feedback when new vulnerabilities are detected or when the impact of existing vulnerabilities changes due to code modifications.
2Reliability
If careful verification is performed on libraries at the time of introduction to ensure security, then the reliability of the system is improved, but the productivity and development speed deteriorate due to time-consuming verification processes
Solution Approach 1:
Static analysis is performed on library source codes before incorporation to detect vulnerabilities in advance. This preliminary verification identifies security issues early, allowing developers to make informed decisions about library selection without extensive manual testing.
Solution Approach 2:
Manual verification processes are replaced with automated static analysis tools that scan library source codes for vulnerability patterns. This substitution dramatically reduces the time and effort required for security verification while maintaining thoroughness.
3Productivity
If simple checks are performed after library introduction to maintain development efficiency, then the productivity is improved, but the reliability deteriorates as vulnerabilities go unnoticed over time
Solution Approach 1:
The patent implements continuous monitoring and periodic re-evaluation of incorporated libraries. Instead of one-time verification, the system continuously tracks library vulnerability status and detects changes over time, ensuring ongoing security without requiring intensive manual intervention.
Solution Approach 2:
The system provides automated feedback when vulnerabilities are detected through continuous monitoring. Developers receive notifications about new security issues, enabling them to address problems promptly while maintaining development efficiency through automated alerting rather than manual checking.
4Measurement precision
If comprehensive verification is performed repeatedly to track changing risk levels, then the measurement precision of risk evaluation is improved, but the loss of time and computational resources increases
Solution Approach 1:
The patent performs dynamic analysis at predetermined intervals rather than continuously. The system schedules periodic re-evaluations of libraries to detect changes in vulnerability status, balancing measurement precision with time efficiency by checking at appropriate frequencies based on project needs.
Solution Approach 2:
The verification frequency and depth are dynamically adjusted based on project stage, library criticality, and detected risk levels. High-risk libraries undergo more frequent and thorough analysis, while low-risk libraries receive less intensive monitoring, optimizing resource allocation.
Data Source
AI summary
In order to provide an evaluation apparatus that appropriately evaluates risk of a source code changing over time, an evaluation apparatus includes a generating unit and an output unit. The generating unit generates an evaluation related to risk of a first library described in a source code. The output unit calculates the degree of risk of the fist library, based on at least the generated evaluation, calculates a risk value indicating risk inherent in the source code, based on the calculated degree of risk, and also outputs time-series data of the calculated risk value.