Open-Source Vulnerability Graph Queries With Automatic Deduplication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing software development technologies face challenges in efficiently managing and analyzing vulnerabilities in open-source components, leading to duplicate documentation and requiring manual mode selection for query execution, which lacks consistency and precision.
Innovation Solution
A Security Domain Graph Language (SGL) is introduced to create and maintain a graph database for open-source components, enabling automatic deduplication and optimization of vulnerability queries through schema-based type checking, query rewriting, and mode selection based on heuristics, ensuring consistency and efficiency in vulnerability analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual vulnerability analysis is performed using centralized vulnerability datasets, then vulnerability detection can be conducted, but the process is time-consuming and prone to human error
Solution Approach 1:
The patent replaces manual mechanical analysis processes with automated graph computing systems. The graph traversal language automatically executes vulnerability queries across the software supply chain graph, substituting human analysts with algorithmic processing that is both faster and more accurate.
Solution Approach 2:
The system enables self-service vulnerability analysis by providing automated query execution and result generation. The graph computing framework automatically traverses the vulnerability graph and generates reports without requiring manual intervention, allowing the system to serve itself in the vulnerability detection process.
2Reliability
If graph database queries are executed without optimization, then complete vulnerability analysis can be performed, but runtime is excessive
Solution Approach 1:
The patent applies preliminary action by pre-computing and caching graph traversal results, pre-processing vulnerability data into graph structures, and preparing optimized query execution plans before actual vulnerability analysis is needed. This reduces runtime when queries are executed.
Solution Approach 2:
The system changes parameters by dynamically adjusting graph traversal depth, breadth, and filtering criteria based on query requirements. The graph traversal language allows parameterized queries that can be optimized for different analysis scenarios, balancing completeness with execution speed.
3Quantity of substance
If duplicate vulnerability entries are not deduplicated, then all discovered vulnerabilities are retained, but data redundancy increases and analysis efficiency decreases
Solution Approach 1:
The patent extracts and removes duplicate vulnerability entries from the graph database results. The system identifies redundant vulnerability data through graph traversal and applies deduplication logic, extracting only unique vulnerability instances while maintaining complete vulnerability coverage.
4Adaptability or versatility
If users must manually choose execution modes in graph databases, then flexible query control is possible, but system complexity increases and ease of operation decreases
Solution Approach 1:
The graph traversal language implements self-service by automatically selecting and configuring the appropriate execution mode based on the query characteristics and data distribution. The system autonomously determines whether to use breadth-first, depth-first, or other traversal strategies without requiring user specification.
Solution Approach 2:
The patent creates a universal graph traversal language that handles multiple execution modes and optimization strategies through a single unified interface. This multi-functional language can adapt to different query types and data scenarios while presenting a consistent, simple syntax to users.
Data Source
AI summary
To analyze open-source code at a large scale, a security domain graph language (“SGL”) has been created that functions as a vulnerability description language and facilitates program analysis queries. The SGL facilitates building and maintaining a graph database to catalogue vulnerabilities found in open-source components. This vulnerability database generated with SGL is used for analysis of software projects which use open source components. An agent which interacts with the vulnerability database can perform a scan of a software project to identify open-source components used in the project and submit queries to the vulnerability database to identify vulnerabilities which may affect the open-source components in the project. Results of the scan are presented to a user in the form of a vulnerability report which indicates vulnerabilities that have been discovered and which open-source components the vulnerabilities affect.