Unified Query Language for Static and Dynamic Security Testing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting application-level vulnerabilities in software, such as lexical analysis of source code, often result in large numbers of false positives and are impractical due to the complexity of modern software suites, and existing query languages are not adaptable for both static and dynamic security testing.
Innovation Solution
A unified query language is developed to configure and operate static and dynamic application security testing tools, allowing for the detection of security vulnerabilities by analyzing source code and runtime events, using data flow graphs and instrumentation techniques to identify vulnerabilities like SQL injection and cross-site scripting.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If lexical analysis of source code is used to detect vulnerabilities, then detection coverage is achieved, but false positive rate increases and practicality decreases
Solution Approach 1:
The patent introduces an intermediate representation (IR) as a mediator between source code and vulnerability detection rules. The source code is first transformed into IR, which simplifies the complexity while preserving semantic information. This intermediary layer enables more accurate and efficient vulnerability detection without directly analyzing the full complexity of the original source code, thereby reducing false positives while maintaining detection coverage.
2Measurement precision
If line-by-line code analysis is performed, then detailed vulnerability detection is possible, but implementation becomes impractical due to large code volumes
Solution Approach 1:
The patent segments the code analysis process into distinct phases: source code parsing into intermediate representation, IR transformation into data flow graphs, and vulnerability rule application on the graphs. This segmentation allows the system to avoid exhaustive line-by-line analysis while maintaining precision by focusing computational resources on transformed representations that preserve critical security-relevant information.
Solution Approach 2:
The patent changes the parameter representation of code from textual source code to structured intermediate representation and then to graphical data flow representations. This parameter transformation enables more efficient processing by converting unstructured text into structured data that can be analyzed using graph-based algorithms, significantly improving analysis efficiency while maintaining detection precision.
3Reliability
If separate query languages are used for static and dynamic testing tools, then each tool can be optimized, but system complexity and adaptability decrease
Solution Approach 1:
The patent creates a unified query language that serves both static analysis (on data flow graphs from source code) and dynamic analysis (on runtime event traces). This universal language allows the same querying mechanism to work across different testing modes, improving adaptability and reducing system complexity while maintaining the ability to perform specialized analyses in each mode through the same interface.
Data Source
AI summary
A computer program is evaluated for security vulnerabilities by formulating a query in a query language and receiving into a memory of a computer source code of the computer program to be analyzed, preparing a data flow graph from the source code, and determining that the query is satisfied by an analysis of the data flow graph. Alternatively, the computer program is evaluated by collecting runtime events during an execution of binary code and determining that the query is satisfied by an analysis of the runtime events. In either case a security vulnerability is reported.