Vulnerability Normalization and Deduplication for DevOps
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The DevOps teams face overwhelming challenges in managing and addressing numerous security issues generated by multiple software scanning tools across various types of artifacts, leading to a need for a system that can normalize, compress, and make these issues actionable.
Innovation Solution
A system employing event-driven and microservice architecture patterns creates disposable software clones for scanning, normalizes and compresses outputs from multiple scanning tools, removes duplicates, and tracks remediations to provide actionable notifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple software scanning tools are used to detect security vulnerabilities, then detection coverage and reliability are improved, but the quantity of security issues and device complexity increase
Solution Approach 1:
The patent combines outputs from multiple software scanning tools by normalizing their results into a common format and merging duplicate or overlapping security issues. This consolidation reduces the total quantity of issues while preserving the comprehensive detection coverage achieved through multiple tools.
Solution Approach 2:
The system implements a universal normalization layer that handles outputs from different scanning tools with varying formats and structures. This multi-functional approach allows the system to process diverse tool outputs through a single standardized interface, effectively managing the complexity of multiple tools without proportionally increasing issue quantity.
2Reliability
If multiple software scanning tools are used to detect security vulnerabilities, then detection coverage is improved, but device complexity increases
Solution Approach 1:
The patent introduces a normalization service as an intermediary layer between multiple scanning tools and the issue management system. This mediator translates and standardizes outputs from various tools into a common format, reducing system complexity by providing a single integration point rather than requiring separate handling for each tool.
Solution Approach 2:
The system changes the parameter format of security issues by normalizing their structure, data types, and representation across different scanning tools. This parameter standardization simplifies downstream processing and reduces system complexity while maintaining the ability to handle diverse tool inputs.
3Loss of information
If all raw security issues are presented to DevOps teams, then completeness of information is improved, but ease of operation deteriorates
Solution Approach 1:
The patent extracts and removes duplicate security issues from the complete set of raw results while preserving all unique vulnerabilities. This extraction process maintains information completeness by retaining all distinct security problems while eliminating redundant entries that would otherwise overwhelm DevOps teams.
Solution Approach 2:
The system discards duplicate security issues that represent the same underlying vulnerability detected by multiple tools or scans. By recovering and presenting only the essential unique issues, the system maintains complete security information while significantly improving ease of operation for DevOps teams.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on a computer storage medium, for normalizing, compressing, and correlating vulnerabilities are disclosed. In one aspect, a method includes the actions of generating a first and second copy of a software target. The actions further include providing the first copy to a first scanning tool and the second copy to a second scanning tool. The actions further include receiving a first scanning tool output that identifies a first issue of the software target. The actions further include receiving a second scanning tool output that identifies a second issue of the software target. The actions further include determining that the first issue and the second issue are a same issue. The actions further include generating a combined issue of the first issue and the second issue. The actions further include outputting a notification that includes the combined issue.