Static Dynamic Security Analysis Integration

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing software security testing methods are limited in identifying security issues within computer code, as static analysis cannot provide accurate information on the underlying cause of vulnerabilities, and dynamic testing lacks comprehensive insights due to external probing limitations.

Innovation Solution

Combining static analysis data with dynamic security testing information to identify and compare security issues, thereby reporting common vulnerabilities and enhancing the accuracy of security assessments by linking static analysis results with dynamic testing outcomes.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Quantity of substance

If static analysis is used to identify security issues, then comprehensive code coverage is achieved, but accurate identification of underlying vulnerability causes is limited

Engineering Contradiction:

Improvesecurity issues identifiedVSAvoidaccuracy of vulnerability cause identification

Core Design Contradiction:

Quantity of substanceVSMeasurement precision

Solution Approach 1:

The patent combines static analysis and dynamic testing results into a unified security assessment system. The comparison module merges data from both methods, correlating static analysis findings with dynamic testing outcomes to produce integrated security reports that leverage the comprehensive coverage of static analysis while incorporating the execution-based accuracy of dynamic testing.

Inventive Principle:

Principle #5Merging (Combining)

2Measurement precision

If dynamic testing is used to identify security issues, then execution-based vulnerability detection is achieved, but comprehensive insights are limited due to external probing constraints

Engineering Contradiction:

Improveexecution-based vulnerability detection accuracyVSAvoidcomprehensive security insights

Core Design Contradiction:

Measurement precisionVSQuantity of substance

Solution Approach 1:

The system uses dynamic testing results as feedback to refine and prioritize static analysis findings. The comparison module analyzes correlations between dynamic testing outcomes and static analysis data, using this feedback to enhance the overall security assessment accuracy and provide more comprehensive insights than either method could achieve alone.

Inventive Principle:

Principle #23Feedback

3Productivity

If only static analysis is performed, then analysis speed is maintained, but security assessment completeness is reduced

Engineering Contradiction:

Improveanalysis speedVSAvoidsecurity assessment completeness

Core Design Contradiction:

ProductivityVSReliability

Solution Approach 1:

The system performs static analysis as a preliminary action to identify potential security issues before executing dynamic testing. This allows the system to quickly screen codebases using static analysis and then focus dynamic testing resources on high-priority areas, maintaining overall analysis speed while improving security assessment completeness through the subsequent dynamic testing phase.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS8528093B1Apparatus and method for performing dynamic security testing using static analysis data

Publication Date: 2013.09.03 MICRO FOCUS LLC

AI summary

A computer readable storage medium includes executable instructions to perform a static analysis of a set of target code to identify a first set of security issues. A dynamic analysis of the target code is executed to identify a second set of security issues. The first set of security issues and the second set of security issues are compared and common security issues are reported.