Static Dynamic Web Code Analysis for Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current source code analysis tools face challenges in accurately detecting security vulnerabilities due to high rates of false positives and false negatives, with static analysis prone to false positives and dynamic analysis prone to false negatives, leading to inefficiencies in identifying relevant security issues.
Innovation Solution
A combined static and dynamic analysis method is implemented, where a static source code analysis module on a server-side device analyzes source code data, requests context information from a dynamic source code analysis module on a client-side device, and updates results based on dynamic analysis data, leveraging the strengths of both approaches to reduce false positives and negatives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If static source code analysis is used, then analysis can be performed without executing code, but false positives increase
Solution Approach 1:
The patent combines static source code analysis (SSCA) and dynamic source code analysis (DSCA) into a unified system. The SSCA module performs static analysis to identify potential vulnerabilities, while the DSCA module executes the code to verify actual behavior. The results from both analyses are integrated to produce final security assessment results, reducing false positives while maintaining efficient analysis.
2Measurement precision
If dynamic source code analysis is used, then actual code execution behavior is analyzed, but false negatives increase
Solution Approach 1:
The system implements feedback mechanisms where the SSCA module sends analysis targets to the DSCA module, which executes the code and returns results. The DSCA module uses feedback from SSCA to focus dynamic analysis on specific suspicious code paths identified statically. This feedback loop ensures that dynamic analysis complements rather than replaces static analysis, improving overall detection completeness.
3Productivity
If only static analysis is performed, then analysis speed is maintained, but detection completeness decreases
Solution Approach 1:
The analysis system is segmented into two independent but coordinated modules: SSCA module for static analysis and DSCA module for dynamic analysis. Each module operates with its own strengths - SSCA provides rapid initial screening without execution overhead, while DSCA performs targeted execution-based verification. This segmentation allows the system to maintain high productivity through parallel operation while achieving comprehensive detection through coordinated analysis.
Data Source
AI summary
Implementations of the present disclosure include methods, systems, and computer-readable storage media for receiving, by a SSCA module of a server, source code data based on one or more web pages of a website, analyzing, by the SSCA module, the source code data using static analysis to provide initial results, the initial results including identifiers respectively assigned to one or more variables provided in the source code data, transmitting, by the SSCA module, a request to the website through a proxy server, the request being based on the initial results, the proxy server receiving a response and transmitting a rewritten response to a DSCA module executed on a client, receiving, by the SSCA module, updated source code data from the DSCA module, the updated source code data being provided based on the rewritten response, and updating, by the SSCA module, the initial results based on the updated source code data.