Vulnerability Identification Using Call Graph Traversal and ML
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for identifying vulnerabilities in software code often result in high false positive rates and lack actionable intelligence, making it difficult to accurately determine true vulnerabilities that can arise during execution.
Innovation Solution
The method involves collecting information on known Common Vulnerabilities and Exposures (CVEs), analyzing metadata using a trained model to identify vulnerable functions, generating vulnerability symbols, and creating a call graph to determine true vulnerabilities by traversing the graph and aggregating patches for these functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional vulnerability identification methods are used, then vulnerability detection coverage is achieved, but false positive rate increases and actionable intelligence decreases
Solution Approach 1:
The system performs preliminary actions by collecting CVE information and training the model on vulnerability data before actual vulnerability identification. The call graph is constructed in advance to establish function relationships, enabling more accurate vulnerability detection during execution by having the model pre-learning from patch commits and vulnerability patterns.
Solution Approach 2:
A trained machine learning model serves as an intermediary between raw vulnerability data and vulnerability identification. The model processes CVE information, function metadata, and call graph data to determine whether identified functions represent true vulnerabilities, filtering out false positives through learned patterns from training data.
2Loss of information
If comprehensive vulnerability analysis is performed, then actionable intelligence increases, but system complexity increases
Solution Approach 1:
The vulnerability analysis system is segmented into distinct modular components: CVE information collection module, call graph construction module, function identification module, model training module, and vulnerability determination module. Each module handles a specific aspect of the analysis, making the complex system manageable and maintainable while preserving comprehensive vulnerability detection capabilities.
3Measurement precision
If manual vulnerability verification is used, then accuracy improves, but productivity decreases
Solution Approach 1:
The system performs self-service through automated machine learning model evaluation of identified functions. The trained model automatically determines whether a function represents a true vulnerability by analyzing the call graph and function metadata, eliminating the need for manual verification while maintaining high accuracy through learned vulnerability patterns.
Data Source
AI summary
Embodiments of the disclosure provide systems and methods for accurately identifying functions in software code that represent vulnerabilities. Identifying vulnerable functions in software code can comprise collecting information identifying one or more known Common Vulnerabilities and Exposures (CVEs) and identifying one or more vulnerable functions in the software code based on relationships between the collected information identifying the one or more known CVEs and the one or more vulnerable functions in the software code. A call graph can be derived for the software code based on the identified one or more vulnerable functions. Each of the identified one or more vulnerable functions can be indicated in the call graph by a vulnerability symbol. A determination can be made as to whether each identified one or more vulnerable functions is a true vulnerability, i.e., when the vulnerable function is encountered when traversing the call graph.