Static Security Analysis via Data Flow Fact Encoding

The patent segments the complex string analysis problem into two distinct phases: a fast taint analysis phase that identifies potential vulnerability paths, and a precise string analysis phase that only verifies suspicious paths. This segmentation allows the system to achieve both high scalability through the efficient taint analysis and high measurement precision through the targeted string analysis on selected paths only.

The patent implements a feedback mechanism where the taint analysis results guide the string analysis phase. The system uses the fast taint analysis to identify suspicious data flows, then applies precise string analysis only to those specific paths. This feedback loop eliminates false positives by verifying actual vulnerability paths and reduces false negatives by focusing computational resources on high-risk areas identified by the taint analysis.

The patent performs preliminary taint analysis before conducting the more expensive string analysis. The taint analysis phase pre-identifies suspicious data flow paths that are likely to contain vulnerabilities. By performing this preliminary filtering action, the system avoids executing time-consuming string analysis on all possible paths, thereby significantly reducing total analysis time while maintaining high measurement precision on the critical paths that are actually analyzed.

The patent implements self-service through automated taint analysis that requires no manual refactoring or annotation from developers. The system automatically instruments the code to track data flows and identify suspicious paths. This self-service approach eliminates the burden of manual code preparation while maintaining high measurement precision, as the automated analysis focuses computational resources on the most critical vulnerability paths without requiring developer intervention.