Threat Change Pattern Detection for CI/CD Security Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information security control technologies are inadequate for efficiently detecting and mitigating application security threats in a continuous integration/continuous deployment (CI/CD) pipeline process.
Innovation Solution
A system comprising a processor and memory that executes distinct security models to analyze development code sets, using static and run-time security models to detect and remediate threat objects, and dynamically triggers development security models based on threat change patterns and quartile weight analysis to improve threat detection accuracy and efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If conventional information security control technologies are used to analyze application code, then security analysis can be performed, but the analysis is not reliable and efficient enough for CI/CD pipeline processes
Solution Approach 1:
The patent segments the security analysis process into multiple distinct security models (static security model, run-time security model, development security model) that operate at different stages of the CI/CD pipeline. Each model handles specific aspects of threat detection, allowing parallel processing and reducing bottlenecks while maintaining comprehensive coverage through specialized analysis approaches.
Solution Approach 2:
The patent dynamically adjusts analysis parameters including threat thresholds, quartile weights, and confidence levels based on historical data and current risk assessments. The system modifies detection sensitivity and false positive tolerance parameters to optimize the balance between detection reliability and analysis efficiency for different code sets and threat scenarios.
2Measurement precision
If multiple distinct security models are executed to analyze development code sets, then threat detection accuracy improves, but system complexity increases
Solution Approach 1:
The patent implements dynamic model selection and configuration where the system activates specific security models based on real-time conditions, code characteristics, and threat profiles. The architecture allows models to be dynamically added, removed, or adjusted without reconfiguring the entire system, managing complexity through adaptive rather than static model deployment.
Solution Approach 2:
The patent introduces intermediary components including a central coordinator that manages model execution, a data normalization layer that standardizes inputs across different models, and a results aggregation service that synthesizes findings. These intermediaries simplify the interaction between multiple security models and the rest of the system, reducing overall complexity while maintaining detection accuracy.
3Reliability
If static security model analyzes each development code set to detect threat objects, then security threats can be identified early, but processing time increases
Solution Approach 1:
The patent applies partial analysis by focusing the static security model on high-risk code sections identified through preliminary scanning, rather than analyzing every line of code uniformly. The system performs excessive analysis only on critical paths and vulnerable patterns, skipping routine or low-risk code segments to reduce overall processing time while maintaining early detection capability for significant threats.
Solution Approach 2:
The patent implements preliminary filtering and classification of code sets before they reach the full static security model analysis. Common patterns, known safe code, and low-risk segments are pre-identified and marked for reduced analysis, allowing the system to prepare and prioritize code sections that require intensive scrutiny, thereby reducing total processing time while maintaining early threat detection.
4Measurement precision
If run-time security model analyzes combined development code sets, then false positive measurements can be determined, but resource utilization increases
Solution Approach 1:
The patent implements periodic sampling and batch processing where the run-time security model analyzes code sets at specific intervals rather than continuously. The system processes code in batches, performing comprehensive false positive identification periodically while using lighter-weight monitoring between batches. This approach maintains measurement precision for false positive detection while significantly reducing average resource utilization compared to continuous analysis.
Data Source
AI summary
A system for detecting and mitigating application security threats comprises a processor associated with a server. The processor executes a static security model to analyze a group of development code sets for an application to detect threat objects. The processor determines that a number of threat objects in each development code set is lower than a threshold. The processor further executes a run-time security model to analyze the combined code sets to determine a set of threat object measurements of application product releases for the application. The processor generates a set of threat change ratios per application based on a first threat object measurement and the threat object measurements after the first threat object measurement. The processor determines threat change patterns of the threat change ratios associated with the application product releases for the application. The processor determines whether to trigger a development security model for the application.