Static Analysis Correlation Scanners for Malicious App Verdicts
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing data platforms face challenges in securing applications from malicious actors who exploit application frameworks to pose threats such as data exfiltration, account compromise, and intellectual property theft, with current static analysis tools lacking confidence in identifying malicious applications and requiring manual review.
Innovation Solution
Implementing a correlation scanner that automates the analysis by combining outputs from multiple static analysis tools and rules, determining an overall verdict based on the interaction of these outputs to enhance confidence in identifying malicious content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple static analysis tools are used to scan application packages, then the coverage of detecting potential malicious content is improved, but the complexity of analyzing and correlating the outputs from these tools increases
Solution Approach 1:
The patent combines outputs from multiple static analysis tools (SAST, DAST, SCA, container image scanners) into a unified analysis framework. The correlation scanner merges scan results, deduplicates findings, and correlates data across different tool outputs to produce a consolidated security assessment, resolving the complexity of handling multiple separate tool outputs.
Solution Approach 2:
The patent introduces an intermediary correlation scanner that acts as a mediator between multiple static analysis tools and the final security verdict. This intermediary component receives, processes, and correlates outputs from various tools, transforming complex multi-tool outputs into actionable security insights and reducing analysis complexity.
2Object-affected harmful factors
If static analysis tools are used to identify malicious applications, then security threats can be detected, but the confidence in the identification is insufficient requiring manual review
Solution Approach 1:
The patent implements feedback mechanisms where scan results from multiple tools are correlated and used to reinforce or challenge each other's findings. The system provides confidence scores based on the convergence of evidence from different analysis tools, and uses this feedback to automatically adjust verification requirements, thereby increasing identification confidence while reducing manual review needs.
Solution Approach 2:
The patent creates a composite security assessment by combining results from multiple different static analysis tools (SAST, DAST, SCA, container scanners). This composite approach aggregates diverse detection methodologies to produce a more reliable and confident identification of malicious applications, where the strength of the overall assessment exceeds that of individual tools.
3Measurement precision
If manual review is performed to verify static analysis results, then the accuracy of malicious application identification is improved, but the time and resources required increase
Solution Approach 1:
The patent applies partial manual review by using automated correlation scanning to pre-process and prioritize results, performing full manual review only on cases that meet specific confidence thresholds or exhibit ambiguous findings. This selective approach maintains high identification accuracy while significantly reducing the volume of cases requiring manual review, thereby improving overall productivity.
4Reliability
If comprehensive scanning with multiple tools is performed, then the security coverage is improved, but the time required for the scanning process increases
Solution Approach 1:
The patent performs preliminary correlation and deduplication of scan results immediately after individual tools complete their scanning. By pre-processing outputs to eliminate redundant findings and prioritize critical issues before comprehensive analysis, the system maintains thorough security coverage while reducing the overall time required for the complete scanning process.
Data Source
AI summary
An anti-abuse scanning system and method for an application deployment platform is provided. In some examples, when a provider submits a new application package, a scan scheduler periodically polls for and detects the new submission. An anti-abuse scan service parses the installer script to determine dependencies between a primary application source code scan, and secondary container image scans. The primary and secondary scans are queued by writing records to status tables. A scan manager polls the tables, detects pending scans, and invokes scanner services to analyze the application files and container images based on configured rules. An image service extracts and uploads container images. The anti-abuse scan service aggregates the primary and secondary scan results to determine an overall verdict for the application package. In some examples, the verdict can be an automatic approval, automatic rejection, or trigger a manual review.