Vulnerability Detection via Execution Context Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting vulnerabilities in software, particularly in dynamically typed programming languages, are limited as they cannot effectively analyze code during early stages of development and may cause side effects or produce unreliable results, lacking a hybrid approach that combines the advantages of Static, Dynamic, and Interactive Application Security Testing (AST).
Innovation Solution
A method involving a compiler and virtual machine that inserts additional instructions into the source code to track the execution context, using a ruleset code to define an admissible execution context, allowing for accurate detection of vulnerabilities by executing the code within a controlled environment and intercepting API calls to identify discrepancies between actual and admissible contexts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If Static Code_analysis (SAST) is used to analyze source code at early development stages, then analysis can be performed before execution, but it cannot reliably analyze dynamically typed languages and produces higher false positive rates
Solution Approach 1:
The patent combines Static Code_analysis (SAST) and Dynamic Application Security Testing (DAST) into a hybrid approach. The compiler inserts instrumentation code into source code during compilation, and the virtual machine executes this instrumented code while tracking execution context. This merging allows early-stage analysis capabilities of SAST with the precision of DAST, resolving the contradiction between early analysis timing and detection accuracy.
2Measurement precision
If Dynamic Application Security Testing (DAST) is used to observe running application behavior, then analysis precision is improved, but the code must be fully functional and execution environment must be available
Solution Approach 1:
The patent performs preliminary action by inserting instrumentation code into the source code during the compilation phase, before the application is fully functional. The compiler adds tracking instructions that prepare the code for dynamic analysis, eliminating the need for a complex execution environment setup. This allows vulnerability analysis to begin at the compilation stage rather than requiring a deployed application.
3Measurement precision
If Dynamic Application Security Testing (DAST) or Interactive AST (IAST) is used to scan running applications, then precise behavior observation is achieved, but side effects occur and scan reproducibility is limited
Solution Approach 1:
The patent introduces a virtual machine as an intermediary layer between the source code and the execution environment. The virtual machine executes the instrumented code in a controlled, isolated environment and tracks execution context through structured data collection. This intermediary approach enables precise behavior observation while preventing side effects on the original system and ensuring reproducible scans through consistent virtual machine execution.
4Measurement precision
If code is compiled and executed for vulnerability analysis, then dynamic behavior can be observed, but only executed branches are analyzed while dead branches remain unnoticed
Solution Approach 1:
The patent makes the analysis process dynamic by instrumenting the code to track execution context and using the virtual machine to dynamically explore different execution paths. The instrumentation code adds tracking instructions that enable the system to adaptively follow control flow, evaluate conditional branches, and maintain execution state information, allowing comprehensive coverage of both executed and potentially reachable code paths during virtual machine execution.
Data Source
AI summary
A method, an apparatus, and a storage medium for detecting vulnerabilities in software to protect a computer system from security and compliance breaches are provided. The method includes providing a ruleset code declaring programming interfaces of a target framework and including rules that define an admissible execution context when invoking the programming interfaces, providing a source code to be scanned for vulnerabilities; compiling the source code into a first execution code having additional instructions inserted to facilitate tracking of an actual execution context of the source code, compiling the ruleset code into a second execution code that can be executed together with the first execution code, executing the first execution code within an virtual machine and passing calls of the programming interfaces to the second execution code, and detecting a software vulnerability when the actual execution context disagrees with the admissible execution context.