Vulnerability Identification in Open Source Code via Dependency Graphs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Identifying and addressing vulnerabilities in open source code used within a user's codebase is challenging, especially in complex projects, where it is unclear which open source components are used and whether they contain vulnerabilities, and there is a risk of legal and security issues due to the need to share modified code or expose proprietary information.
Innovation Solution
A method and system that creates a dependency graph of the user's code using static analysis, identifying reachable open source components with vulnerabilities, and backtracking to their roots, allowing for the isolation of vulnerable components without exposing the user's code, using a server with access to known vulnerabilities, and iteratively refining the graph to lower-level components.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If static analysis is used to create a dependency graph of the user's code, then vulnerability identification accuracy is improved, but the complexity of the analysis process increases
Solution Approach 1:
The patent segments the codebase into a dependency graph structure, breaking down the complex analysis task into manageable components (nodes and edges). This allows systematic traversal and analysis of individual components and their relationships, improving vulnerability identification accuracy while managing analysis complexity through structured decomposition.
Solution Approach 2:
The patent performs preliminary static analysis to construct the complete dependency graph before vulnerability scanning. By pre-processing the codebase to establish all component relationships in advance, the system enables more accurate and efficient vulnerability identification during the actual scanning phase, avoiding the need for complex real-time analysis.
2Measurement precision
If the system backtracks to root components to isolate vulnerable open source components, then the precision of vulnerability localization is improved, but the time required for analysis increases
Solution Approach 1:
The patent pre-computes and stores the dependency graph structure including all paths from root components to leaf components before vulnerability analysis. When a vulnerability is detected, the system can quickly backtrack using the pre-established graph structure rather than performing exhaustive path analysis, thereby improving localization precision while minimizing additional time consumption.
Solution Approach 2:
The patent creates a computational model (dependency graph) that copies the structural relationships of the actual codebase. This model allows the system to perform backtracking and path analysis on the graph representation rather than the original code, significantly reducing the time required for vulnerability localization while maintaining precise identification of affected components.
3Reliability
If the system transmits dependency graph information to an external server, then vulnerability detection capability is improved, but the risk of exposing proprietary information increases
Solution Approach 1:
The patent extracts and transmits only the necessary dependency graph metadata to external servers for vulnerability matching, deliberately excluding sensitive source code and proprietary information. This selective extraction approach enables the system to leverage external vulnerability databases and analysis capabilities while minimizing the exposure of confidential information, as only structural relationship data is shared.
Solution Approach 2:
The patent introduces an intermediary processing layer that anonymizes and aggregates dependency graph information before transmission to external servers. This intermediary layer strips identifying details and transforms the data into a standardized format that preserves vulnerability detection capability while preventing the exposure of proprietary code structures and business logic.
4Measurement precision
If the system iteratively refines the dependency graph to lower-level components, then the detail of vulnerability information is improved, but the computational resources required increase
Solution Approach 1:
The patent applies iterative refinement selectively to only those portions of the dependency graph that contain or are related to detected vulnerabilities. Instead of uniformly refining the entire graph to the lowest level, the system focuses computational resources on local areas of interest, thereby improving vulnerability information detail where needed while minimizing overall computational resource consumption.
Solution Approach 2:
The patent performs partial refinement of the dependency graph, stopping at the appropriate level of detail for each vulnerability case rather than always proceeding to the finest granularity. This partial action approach provides sufficient detail for effective vulnerability management while avoiding the excessive computational costs of complete fine-grained analysis across the entire codebase.
Data Source
AI summary
A method, computerized apparatus and computer program product, the method comprising: obtaining computer code; determining from the computer code a collection of components reachable from the computer code; providing information about the components to a server; identifying by the server using information retrieved from a database, reachable components associated with the collection of components, which have stored vulnerabilities; determining from the computer code and the reachable components that have stored vulnerabilities, a collection of reachable finer resolution components; identifying, further components from the collection of reachable finer resolution components, which have stored vulnerabilities; and outputting information about the further components, wherein the computer code cannot be reconstructed from the information about the collection of components and the information about the finer resolution components.