Vulnerability Classification Using AST and Property Correlations

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Static security analysis tools often produce numerous false positive reports of security vulnerabilities in computer software due to their imprecise representation of applications, and they fail to differentiate between vulnerabilities in terms of exploitability and severity.

Innovation Solution

A method for automatically classifying security vulnerabilities by identifying candidate vulnerabilities, determining predefined property values, creating correlations between these values and classifications, and using these correlations to classify vulnerabilities in new applications, employing machine learning techniques like the k-means algorithm.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If static security analysis is performed to uncover security vulnerabilities, then security issues are identified, but false positive reports increase due to imprecise representation

Engineering Contradiction:

Improveaccuracy of vulnerability detectionVSAvoidfalse positive reports

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The patent introduces an abstract syntax tree (AST) as an intermediary representation between the source code and the analysis engine. This AST serves as a structured mediator that preserves precise syntactic and semantic information while enabling systematic analysis, thereby reducing false positives caused by imprecise direct analysis of source code

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent transforms the vulnerability classification problem by changing parameters from simple binary detection to multi-dimensional classification based on exploitability and severity. This parameter transformation enables more nuanced differentiation of vulnerabilities, improving accuracy while reducing false positives through better contextual understanding

Inventive Principle:

Principle #35Parameter changes

2Quantity of substance

If all security vulnerabilities are reported without classification, then comprehensive coverage is achieved, but prioritization of critical issues becomes difficult

Engineering Contradiction:

Improvenumber of vulnerabilities reportedVSAvoidprioritization of issues

Core Design Contradiction:

Quantity of substanceVSEase of operation

Solution Approach 1:

The patent segments the set of all vulnerabilities into distinct categories based on exploitability (e.g., easily exploitable, moderately exploitable, difficult to exploit) and severity (e.g., high, medium, low). This segmentation allows comprehensive reporting while enabling easy prioritization through structured classification

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies different classification criteria and weights to different types of vulnerabilities based on their local characteristics. Each vulnerability is evaluated with property values specific to its context (e.g., code location, data flow characteristics), enabling nuanced prioritization that reflects the actual risk of each specific vulnerability

Inventive Principle:

Principle #3Local quality

3Measurement precision

If manual analysis is used to differentiate vulnerability severity, then accurate classification is achieved, but analysis time increases significantly

Engineering Contradiction:

Improveclassification accuracyVSAvoidanalysis time

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The patent implements automated property value determination that allows the analysis system to self-evaluate vulnerabilities without manual intervention. The system automatically computes exploitability and severity metrics based on predefined criteria and code analysis, achieving manual-level accuracy while eliminating time-consuming manual review

Inventive Principle:

Principle #25Self-service

Solution Approach 2:

The patent performs preliminary classification by determining property values and classifications during the initial static analysis phase, before detailed manual review is needed. This preliminary action pre-processes vulnerabilities with automated classification, reducing the time required for subsequent prioritization and response activities

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS8806648B2Automatic classification of security vulnerabilities in computer software applications

Publication Date: 2014.08.12 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

Automatically classifying security vulnerabilities in computer software applications by identifying candidate security vulnerabilities in a learning set including at least a first computer software application, classifying each of the candidate security vulnerabilities using predefined classifications, determining, for each of the candidate security vulnerabilities, values for predefined properties, creating a set of correlations between the property values and the classifications of the candidate security vulnerabilities, identifying a candidate security vulnerability in a second computer software application, determining, for the candidate security vulnerability in the second computer software application, values for the predefined properties, and using the set of correlations to classify the candidate security vulnerability in the second computer software application with a classification from the predefined classifications that best correlates with the property values of the candidate security vulnerability in the second computer software application.