Source Code Vulnerability Map Visualization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional static application security testing (SAST) tools generate large sets of weaknesses, making it difficult for users to quickly identify and prioritize vulnerabilities in software applications, as they often produce thousands of individual paths through the code, overwhelming users and requiring extensive time to determine where to focus remediation efforts.
Innovation Solution
A method that processes source code to identify errors, creates a compact data flow map visualization, and displays it on a device interface, allowing users to select locations with the most impact and least harm, by collapsing linear sequences into single nodes and representing data flow paths as a graph with unique stations and edges, facilitating a clearer understanding of vulnerability relationships.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional SAST tools analyze software code to identify vulnerabilities, then security weakness detection is improved, but the number of findings increases to thousands or hundreds of thousands making the results overwhelming and difficult to prioritize
Solution Approach 1:
The patent merges multiple individual vulnerability findings that share common code paths into a single consolidated finding. By identifying that many weaknesses share portions of the path through the code, the system combines these related findings and presents them as one unified result, reducing the total number of findings from thousands to a manageable set while preserving all security information.
Solution Approach 2:
The patent creates a unified finding structure that serves multiple functions simultaneously: it represents individual vulnerabilities, groups related weaknesses, identifies common code paths, and provides prioritization information. This multi-functional finding structure eliminates the need to present separate individual findings for each vulnerability while maintaining comprehensive security coverage.
2Loss of information
If SAST tools present individual paths through application code illustrating how attack data propagates, then vulnerability detail is improved, but it becomes difficult to discern relationships between weaknesses and understand where the application needs the most attention
Solution Approach 1:
The patent combines multiple individual path illustrations into a single consolidated finding that shows the common code path shared by multiple vulnerabilities. This merging preserves the detailed information about how attack data propagates through the code while making it easier to understand relationships between weaknesses by showing them as related components of a single finding rather than separate isolated paths.
3Reliability
If SAST analysis is performed on large applications with millions to tens of millions of lines of code, then comprehensive security coverage is improved, but the time to produce results increases to hours and the time to analyze findings increases to several person days or weeks
Solution Approach 1:
The patent reduces the time to analyze findings by consolidating thousands of individual findings into a smaller set of consolidated findings. This merging process allows security professionals to review fewer results while maintaining comprehensive security coverage, reducing the analysis time from several person days or weeks to a fraction of that time.
Data Source
AI summary
A source code processing application may process source code and realize the results of the code in a map configuration. In one example, the map may be displayed with a number of stations and pathways between the stations to illustrate associations with classes of the source code. An example method of operation may include one or more of retrieving source code comprising a class from memory, processing the source code to identify an error associated with the class, creating a map with a station linked to the error, and displaying the map on a device.