Wrapper Objects for Dynamic Dataflow Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Dynamic analysis of application dataflow struggles to track the complete flow of data between sources and sinks, leading to difficulties in identifying and correcting vulnerabilities, especially in large applications, due to high rates of false positives and resource-intensive copying of data objects.
Innovation Solution
The creation of wrapper objects that point to data objects, with source and flow tracking objects recording information about data sources and processing events, allowing for efficient tracking of dataflow without copying the actual data objects, and associating these tracking objects to depict the dataflow sequence.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If dynamic analysis copies data objects to track dataflow, then complete dataflow tracking is achieved, but resource consumption increases significantly
Solution Approach 1:
The patent applies copying by creating wrapper objects that replicate the structure and behavior of original data objects. These wrapper objects contain tracking information to identify dataflow paths while pointing to the actual data objects, enabling complete dataflow tracking without copying the entire data object content. This resolves the contradiction by providing accurate tracking through structural copies rather than full data copies.
Solution Approach 2:
The patent introduces wrapper objects as intermediary elements between the analysis system and actual data objects. These wrappers act as mediators that contain tracking metadata and maintain references to the original data, allowing the system to track dataflow without directly manipulating or copying the underlying data objects. This intermediary approach enables precise tracking while minimizing resource consumption.
2Measurement precision
If dynamic analysis tracks complete dataflow paths, then vulnerability identification accuracy improves, but false positive rate increases
Solution Approach 1:
The patent segments the dataflow tracking into distinct components: wrapper objects that contain tracking information, reference links to actual data objects, and metadata about dataflow paths. This segmentation allows the system to track complete dataflow paths for accurate vulnerability identification while maintaining the ability to filter and validate findings, thereby reducing false positives through structured analysis.
3Measurement precision
If manual review of source code is performed to identify vulnerabilities, then detailed dataflow analysis is achieved, but time consumption increases significantly
Solution Approach 1:
The patent applies preliminary action by automatically creating wrapper objects and establishing tracking infrastructure before the actual vulnerability analysis begins. The system pre-processes the application by instrumenting data objects with wrappers that contain tracking metadata, so that when vulnerability analysis occurs, the detailed dataflow paths are already captured and organized. This eliminates the need for manual source code review while maintaining detailed analysis capability.
Data Source
AI summary
Data source information is recorded into a source tracking object embedded in a wrapper object pointing to a data object from the data source. Tracking event information is recorded into a flow tracking object embedded in a wrapper object copy as the tracking event processes the wrapper object copy. Other tracking event information is recorded into another flow tracking object embedded in another wrapper object as the other tracking event processes the other wrapper object. The flow tracking object is associated with the other flow tracking object in response to a field retrieval of the wrapper object copy from the other wrapper object. The wrapper object copy is output to a data sink. Data sink information is recorded into a sink tracking object embedded in the wrapper object copy. The tracking objects are output as dynamic analysis of dataflow in the application program.