Static Analysis Vulnerability Verification via Mock Object Unit Tests

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current methods for source code security analysis and web application security scanning often produce false positives and miss vulnerabilities due to coverage issues, especially in rich Internet applications with client-side logic, and require full application deployment, which is impractical for developers working on smaller projects.

Innovation Solution

A computer-implemented process that performs static analysis on source code, generates a vulnerability call trace, and uses mock objects to create unit tests for validating identified vulnerabilities, allowing for dynamic execution without requiring a full application deployment, thereby validating static analysis results and reducing false positives.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Difficulty of detecting and measuring

If static analysis is used to identify security vulnerabilities, then vulnerability detection capability is improved, but false positives increase

Engineering Contradiction:

Improvevulnerability detection capabilityVSAvoidfalse positive rate

Core Design Contradiction:

Difficulty of detecting and measuringVSMeasurement precision

Solution Approach 1:

The system executes unit tests generated from static analysis findings to verify whether identified vulnerabilities actually exist in the running application. The results of these dynamic executions feed back into the analysis process, allowing the system to distinguish between true vulnerabilities and false positives, thereby improving measurement precision while maintaining detection capability

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

Unit tests serve as an intermediary between static analysis and the application under test. Instead of directly analyzing code or attacking the application, the system generates unit tests that act as a mediator to validate findings, reducing false positives by verifying vulnerabilities through controlled execution

Inventive Principle:

Principle #24Intermediary (Mediator)

2Measurement precision

If web application security scanning is used to identify vulnerabilities, then dynamic vulnerability validation is improved, but coverage is reduced due to deployment requirements

Engineering Contradiction:

Improvevulnerability validation accuracyVSAvoidapplication coverage

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The system segments the validation process into two independent parts: static analysis that can be performed on source code without deployment, and unit test execution that validates findings. This segmentation allows the system to work with individual components or modules rather than requiring full application deployment, thereby improving adaptability while maintaining validation accuracy

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system performs preliminary static analysis on source code to identify potential vulnerabilities before any execution occurs. Unit tests are then generated based on these preliminary findings, allowing the system to prepare validation cases in advance without requiring the application to be deployed, thus expanding coverage to include undeployed or partially deployed applications

Inventive Principle:

Principle #10Preliminary action

3Measurement precision

If unit testing is used to verify static analysis results, then false positive reduction is improved, but additional testing overhead is created

Engineering Contradiction:

Improvefalse positive reductionVSAvoidtesting overhead

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs partial execution of unit tests, focusing only on the specific code paths and scenarios relevant to the static analysis findings rather than executing complete test suites. This partial action approach reduces the time overhead while still achieving false positive reduction by validating only the necessary vulnerability scenarios

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS9160762B2Verifying application security vulnerabilities

Publication Date: 2015.10.13 FINJAN BLUE INC

AI summary

Verifying application security vulnerabilities includes receiving a source code to analyze, performing a static analysis using the received source code and generating a vulnerability call trace for the received source code. Responsive to a determination that all static analysis results are not validated, mock objects are generated using the vulnerability call trace and a unit test is created using the generated mock objects. The unit test is executed using the generated mock objects and responsive to a determination that an identified vulnerability was validated; a next static analysis result is selected. Responsive to a determination that all static analysis results are validated, results and computed unit tests are reported.