Automated Source Code Vulnerability Mitigation via Path Graph Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying and mitigating software security vulnerabilities in source code are labor-intensive and often result in potential security issues being deployed due to lack of time or resources, despite the use of static code analysis tools that detect vulnerabilities and provide generic remediation criteria.
Innovation Solution
A method and system that automatically mitigate vulnerabilities in source code by building a path graph, identifying tainted paths, determining if vulnerabilities are mitigable, and applying instant-fix calls based on vulnerability types, with a processor that compiles source code, locates tainted objects, and creates amended source code, which is then checked for legality and compiler errors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static code analysis tools are used to detect vulnerabilities, then vulnerability detection capability is improved, but manual validation effort increases
Solution Approach 1:
The system performs self-validation by automatically verifying the correctness of generated remediation code through compiler validation and test execution, eliminating the need for manual validation of each fix
Solution Approach 2:
An automated validation intermediary layer is introduced between vulnerability detection and manual review, using compiler validation and test frameworks to verify fixes before deployment
2Reliability
If comprehensive static code analysis is performed, then security coverage is improved, but processing time increases
Solution Approach 1:
The system performs preliminary actions by pre-compiling the source code and pre-identifying potential vulnerability locations before actual vulnerability analysis, enabling faster processing during the main analysis phase
Solution Approach 2:
The code base is segmented into functional units and analyzed in discrete paths, allowing parallel processing and reducing overall analysis time while maintaining comprehensive coverage
3Measurement precision
If multiple vulnerability rules are enabled, then detection accuracy is improved, but false positives increase
Solution Approach 1:
The system uses feedback loops where detected vulnerabilities are validated through multiple checks including compiler validation and test execution, allowing false positives to be identified and filtered out systematically
Solution Approach 2:
The vulnerability detection process is made dynamic by adjusting the strictness of validation based on confidence levels, with higher confidence vulnerabilities requiring less manual review and lower confidence ones undergoing more rigorous validation
Data Source
AI summary
A method for automatically mitigating vulnerabilities in a source code of an application is provided in the present invention. The method includes the following steps. First, the source code is complied, and a path graph is built according to the compiled source code. The path graph includes a plurality of paths traversing from sources to sinks, and each of the paths includes a plurality of nodes. Then, at least one tainted path is identified by enabling a plurality of vulnerability rules. Each of the at least one tainted path corresponds to a vulnerability, and each of the at least one vulnerability corresponds to a sanitization method. Then, the at least one vulnerability is determined if it is mitigable. If the at least one vulnerability is mitigable, the at least one vulnerability is mitigated automatically. Furthermore, the method may be implemented as a system and a computer program product.