Static Application Security Testing Control Flow Graph Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static Application Security Testing (SAST) struggles to accurately identify security vulnerabilities in source code without executing the code, particularly in cases of unchecked data flows from sinks to sources, leading to potential security compromises.
Innovation Solution
The method involves determining control flow graphs and source-sink pairs in source code, using intermediate representations like SSA form, and employing SMT solvers to identify exploitable data sources and sinks, generating security reports that exclude non-exploitable pairs and provide conditions for exploitable ones, thereby reducing false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional SAST methods are used to analyze source code for security vulnerabilities, then security issues can be detected without executing code, but the accuracy of identifying exploitable vulnerabilities is low and false positives are high
Solution Approach 1:
The patent segments the vulnerability analysis process into distinct components: control flow graph construction, data flow path identification, and exploitability condition verification. By dividing the analysis into these modular stages, the system can systematically evaluate each aspect of potential vulnerabilities, improving both accuracy and reliability without requiring full code execution.
Solution Approach 2:
The patent introduces control flow graphs as an intermediary structure between the source code and the vulnerability detection process. These graphs serve as a mediator that models the execution paths and data flows, allowing the system to analyze exploitability conditions statically while maintaining high accuracy. The control flow graph acts as a bridge that enables precise tracking of data from sources to sinks without actual code execution.
2Measurement precision
If comprehensive data flow analysis is performed to identify all potential vulnerabilities, then more security issues are detected, but the number of false positives increases
Solution Approach 1:
The patent changes the parameters used to evaluate vulnerabilities by introducing exploitability conditions as additional filtering criteria. Instead of simply detecting data flows from sources to sinks, the system evaluates whether specific conditions must be met for exploitation to occur. This parameter change allows comprehensive detection while filtering out false positives by assessing the actual exploitability of each identified issue.
3Productivity
If static analysis without code execution is used, then analysis speed is fast and no runtime environment is needed, but the ability to determine actual exploitability is limited
Solution Approach 1:
The patent performs preliminary construction of control flow graphs and identification of data flow paths before conducting the exploitability assessment. By preparing these structural representations in advance, the system maintains fast analysis speed while enabling subsequent precise evaluation of exploitability conditions. The preliminary actions create a foundation that allows accurate static analysis without requiring code execution.
Data Source
AI summary
Methods, systems, and computer-readable storage media for analyzing source code of an application. In some implementations, actions include determining a control flow graph of the application using the source code of the application; determining a plurality of source-sink pairs of exploitable data sources and exploitable data sinks; and determining, for each source-sink pair, whether the source-sink pair is potentially exploitable by: determining one or more conditions under which the invoking procedure passes the exploitable data source to the exploitable data sink of the invoked procedure; and determining, using the control flow graph, whether the conditions are met in at least one possible context of the application, and if so, determining that the source-sink pair is potentially exploitable.