Static Application Security Testing via Procedure Specification Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Static Application Security Testing (SAST) struggles to accurately identify security vulnerabilities in source code without executing it, particularly in cases of unchecked data-flows from sinks to sources, leading to potential security compromises.
Innovation Solution
The method involves analyzing source code by determining procedure specifications to identify exploitable conditions, generating an intermediate representation, and constructing a control flow graph to determine potentially exploitable source-sink pairs, using databases for exploitable sources and sinks, and applying solvers to assess vulnerability contexts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If static application security testing analyzes source code without execution, then testing speed and efficiency are improved, but accuracy in identifying security vulnerabilities deteriorates
Solution Approach 1:
The patent introduces an intermediate representation (IR) as a mediator between the source code and the security analysis. The IR serves as a standardized, language-independent model that captures program semantics, enabling accurate vulnerability detection without requiring execution of the original source code. This intermediary structure allows the system to maintain both high testing speed and accurate vulnerability identification by working with the simplified IR model rather than directly analyzing complex source code.
2Measurement precision
If the system analyzes every procedure invocation to determine exploitability, then vulnerability detection accuracy is improved, but analysis time and processing complexity increase
Solution Approach 1:
The patent performs preliminary analysis by determining procedure specifications before actual vulnerability checking. Each procedure is analyzed once to generate a specification that includes conditions for exploitable parameters. This preliminary work is cached and reused during subsequent vulnerability detection, avoiding the need to re-analyze the same procedure every time it is invoked. This significantly reduces analysis time while maintaining high accuracy.
Solution Approach 2:
The system creates a simplified copy of the procedure specification that captures essential security characteristics without replicating the entire procedure implementation. This specification copy includes only the necessary information about parameters, their types, and exploitability conditions, allowing rapid comparison during vulnerability detection without processing the full source code again.
3Loss of information
If the system generates detailed explanations for each vulnerability finding, then report quality and usability are improved, but output size and processing overhead increase
Solution Approach 1:
The patent applies local quality by providing detailed explanations only for specific vulnerability findings that meet certain criteria, rather than uniformly expanding all findings. The explanation generation is localized to areas where security implications are most significant, such as data flow paths from unsafe sources to vulnerable sinks. This selective approach maintains high report quality for critical issues while avoiding unnecessary verbosity in less critical cases.
Data Source
AI summary
Methods, systems, and computer-readable storage media for analyzing source code of an application. In some implementations, actions include determining, for at least one procedure invoked by the source code, a procedure specification specifying one or more conditions under which one or more parameters of the procedure are exploitable according to a parameter security specification; performing static application security testing on the source code by using the procedure specification on reaching an invocation of the procedure in the source code, including: comparing one or more invoking parameters of the invocation of the procedure to the conditions of the procedure specification; and determining whether the invocation of the procedure is exploitable.