Deployable Software Vulnerability Testing Engine for Library-Level Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Large entities using third-party software applications in their technology infrastructure face challenges in identifying vulnerabilities at a granular level, particularly within specific libraries, as existing security tools lack the capability to detect library-level vulnerabilities.
Innovation Solution
A platform-agnostic deployable software vulnerability testing engine is developed to identify vulnerabilities by receiving user input parameters, generating an SVT engine, and deploying it within the infrastructure to scan for vulnerabilities, including those in specific software libraries, and executing mitigation actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If existing security tools are used to scan for vulnerabilities, then general vulnerability detection is possible, but library-level vulnerability identification capability is insufficient
Solution Approach 1:
The vulnerability scanning process is segmented into multiple levels: application-level scanning and library-level scanning. The system divides the technology infrastructure into discrete components (applications and their dependent libraries) and scans each segment separately using appropriate scanning vectors, enabling precise library-level vulnerability identification while maintaining overall system reliability
Solution Approach 2:
A library dependency database acts as an intermediary between the vulnerability scanner and the technology infrastructure. This database stores information about library dependencies for each application, allowing the scanner to resolve application names to their underlying library dependencies and accurately identify library-level vulnerabilities
2Adaptability or versatility
If a proprietary vulnerability scanner is used, then detection capability is limited to known vectors, but adaptability to new vulnerabilities is reduced
Solution Approach 1:
The vulnerability scanning system is made dynamic and configurable through a graphical user interface that allows users to adjust scanning parameters, select specific vulnerability types, and modify scanning vectors in real-time. This dynamic configuration enables the system to adapt to new vulnerability types and scanning requirements without requiring complex reprogramming or redeployment
Solution Approach 2:
The vulnerability scanner is designed with multi-functionality to handle various scanning scenarios: application-level scanning, library-level scanning, and configurable vulnerability type filtering. The system can scan for different vulnerability types (SQL injection, XSS, etc.) and can be configured to focus on specific applications or libraries, providing universal adaptability across diverse security testing needs
3Measurement precision
If developers update vulnerability detection vectors manually, then detection accuracy improves, but time to address threats increases
Solution Approach 1:
The system performs preliminary actions by automatically resolving application names to library dependencies using the library dependency database before scanning begins. This preliminary resolution ensures that vulnerability detections are accurately mapped to the correct libraries without requiring manual intervention or developer updates, maintaining both accuracy and rapid response time
Data Source
AI summary
Systems, computer program products, and methods are described herein for deployable software vulnerability testing platform. The present invention is configured to receive, from a user input device, an initial request from a user to generate a deployable software vulnerability testing (SVT) engine; prompt an SVT dashboard for display on the user input device to receive one or more input parameters associated with the first vulnerability in response to receiving the initial request; receive, via the SVT dashboard, the one or more input parameters; generate the SVT engine based on at least the one or more input parameters; receive, from the user input device, one or more deployment parameters associated with a deployment of the SVT engine; and deploy the SVT engine within the distributed technology infrastructure to identify the one or more instances of the first vulnerability based on at least the one or more deployment parameters.