Static-Dynamic Code Analysis for Correlated Vulnerability Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software testing methods, including static and dynamic code analysis, produce uncorrelated results with high false positives and false negatives due to incomplete attack surface discovery and lack of integration between static and dynamic scans, leading to inefficient resource utilization and ineffective vulnerability detection.
Innovation Solution
Integrate static and dynamic code analysis by correlating static HTTP to source code mappings with dynamic scanning to filter out futile attacks, using a configuration file generated by static code analysis to guide dynamic scanning, thereby improving precision and reducing unnecessary tests.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static code analysis is used to scan source code for vulnerabilities, then specific source code elements with vulnerabilities can be identified, but false positives are inherent and no attack surface is derived
Solution Approach 1:
The patent merges static code analysis and dynamic code analysis into an integrated system. Static analysis identifies potential vulnerabilities in source code, while dynamic analysis validates these findings by actually executing the code and attempting attacks. The results from both analyses are correlated to produce a unified vulnerability report, combining the comprehensive coverage of static analysis with the validation capability of dynamic analysis.
Solution Approach 2:
The system implements feedback mechanisms where dynamic analysis results are used to validate and refine static analysis findings. When dynamic analysis confirms a vulnerability detected by static analysis, it provides positive feedback that reduces false positives. Conversely, when dynamic analysis shows that a static-detected vulnerability cannot be exploited, this negative feedback is used to adjust the static analysis model and reduce future false positives.
2Reliability
If dynamic code analysis is used to test running application for vulnerabilities, then eternally exposed vulnerabilities with unknown relationship to source code can be identified, but performance is limited due to injecting malicious payloads into HTTP requests
Solution Approach 1:
The system performs preliminary static code analysis before dynamic code analysis to identify potential vulnerabilities and map the attack surface. This preliminary action creates a blueprint that guides the subsequent dynamic analysis, allowing the system to focus on specific high-risk areas rather than blindly testing all possible entry points, thereby improving scanning efficiency.
Solution Approach 2:
The patent introduces an intermediary component that correlates results from static and dynamic analyses. This intermediary processes the data from both analysis methods, validates findings, and produces a unified vulnerability report. It acts as a mediator that reconciles the strengths and weaknesses of both analysis approaches, improving overall detection reliability while optimizing resource utilization.
3Adaptability or versatility
If static and dynamic scans are performed separately on a common application, then two collections of vulnerabilities are provided, but they are unrelatable and cannot be correlated
Solution Approach 1:
The system implements a universal correlation framework that can handle both static and dynamic analysis results within a single integrated model. This framework uses HTTP to source code mapping information to correlate vulnerabilities from both analysis methods, allowing the system to process and reconcile results from multiple analysis approaches using a common methodology.
Solution Approach 2:
The correlation component serves as an intermediary that bridges static and dynamic analysis results. It uses mapping information between HTTP requests and source code to connect vulnerabilities identified by different methods, preserving context information and creating a unified vulnerability view that combines insights from both static and dynamic analyses.
4Area of stationary object
If dynamic scanning is used to discover attack surface, then all different points where unauthorized user may enter data can be identified, but the process is difficult and error prone as many APIs are not documented
Solution Approach 1:
The system performs preliminary static code analysis to discover and map the attack surface before conducting dynamic scanning. By analyzing source code statically, the system can identify APIs, endpoints, and potential entry points without needing to actually execute the application or rely on documentation. This preliminary mapping simplifies the subsequent dynamic scanning process.
Solution Approach 2:
The patent segments the attack surface discovery process into distinct phases: static analysis for initial mapping, dynamic analysis for validation, and correlation for synthesis. Each phase handles specific aspects of attack surface discovery, dividing the complex task into manageable segments that can be processed independently and then integrated.
Data Source
AI summary
Testing software applications often requires a balancing of thoroughness versus the time and computing resources available to perform such tests. By performing a static analysis on candidate software source code and, from the static analysis, configuring a dynamic analysis component to execute the tests, allows for extraneous tests to be omitted. For example, performing certain vulnerability attacks on a function may be futile if the attack requires a string input but the function only accepts integers. By combining static and dynamic analysis, unnecessary tests may be omitted and the results of each analysis process correlated to identify actual vulnerabilities or falsely indicted vulnerabilities reported by one of the static or dynamic analysis component.