Vulnerability Detection via Library Feature Matching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software applications often incorporate vulnerable software libraries that can introduce security risks due to their open nature and potential obfuscation, making it difficult for users to detect and mitigate these vulnerabilities.
Innovation Solution
A system that downloads and stores libraries and applications in a database, extracts features, and compares them to identify associated libraries, flagging security concerns and notifying users of potential vulnerabilities.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If libraries are statically linked and obfuscated to reduce development time and prevent reverse engineering, then application security is improved, but the ability to detect vulnerable libraries is worsened
Solution Approach 1:
The system creates a database of known vulnerable library patterns and feature sets. Instead of trying to reverse engineer obfuscated libraries, it copies and stores the characteristic features of vulnerable libraries in advance, then uses these copies to match against applications. This allows detection without needing to de-obfuscate or reverse engineer the target libraries.
Solution Approach 2:
The system performs preliminary analysis by building a comprehensive database of library features, patterns, and vulnerability signatures before actual application scanning. Libraries are downloaded, analyzed, and their features are extracted and stored in advance in the vulnerability database, so that when an application is scanned, the matching can occur quickly against pre-prepared data.
2Measurement precision
If comprehensive library analysis is performed to detect all vulnerabilities, then detection accuracy is improved, but system complexity and processing time are worsened
Solution Approach 1:
The system extracts only the essential and characteristic features from libraries that are most indicative of vulnerability, rather than analyzing entire library codebases. By taking out and storing only the critical feature sets, patterns, and signatures in the vulnerability database, the system achieves high detection accuracy without requiring complex full-code analysis during scanning operations.
3Reliability
If feature extraction and comparison is performed for all applications to identify associated libraries, then vulnerability identification is improved, but processing time and computational resources are worsened
Solution Approach 1:
The system performs partial feature extraction and comparison by focusing only on the most critical and discriminative features rather than exhaustive analysis of all application code. It uses the pre-built vulnerability database to guide the comparison process, performing excessive action on key features that matter most for vulnerability detection while skipping less relevant analysis, thus achieving good detection accuracy with reduced processing time.
Data Source
AI summary
A method and system of determining a vulnerability of software. Libraries are downloaded and stored in a database. For each library, a set of features are extracted and stored in a library index table of the database. For each library, it is determined whether it poses a security concern and flagged accordingly in the library index table. Applications are downloaded and stored in the database. For each application a set of features are extracted and stored in an application index table of the database. For each application, the set of features of the application of the application are compared to the set of features of each of the libraries in the library index table to identify which libraries in the library index table are associated with the application. For each application, a name of the application and names of the associated libraries are stored in a vulnerability reference table in the database.