Managing security of source code

• US 10,089,463 B1
• Filed: 09/25/2012
• Issued: 10/02/2018
• Est. Priority Date: 09/25/2012
• Status: Active Grant

• Current Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Original Assignee: Emc IP Holding Company LLC (Dell Technologies Inc.)
• Inventors: Katz, Aaron T., Bailey, Daniel V., Amar, Yavir
• Primary Examiner(s): Ho, Dao Q
• Assistant Examiner(s): Zarrineh, Shahriar
• Application Number:
  US13/626,240
• Time in Patent Office: 2,198 Days
• Field of Search: 726 22
• CPC Class Codes: G06F 21/125 by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 21/563 by source code analysis
• CPC Class Codes: G06F 21/57 Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
• CPC Class Codes: G06F 21/60 Protecting data
• CPC Class Codes: G06F 21/645 using a third party
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A method is used in managing security of source code. Source code characteristics are derived from a source code change. Based on the source code characteristics, risk information associated with the source code change is produced.

Claims

1. A computer-implemented method for use in managing security of source code, the computer-implemented method comprising:

receiving, from a user, an electronic request to submit a source code change;

performing an analysis of one or more prior source code changes associated with the user to determine the user'"'"'s typical halstead complexity measure, typical cyclomatic complexity measure, typical afferent coupling measure, and typical efferent coupling measure, wherein said halstead measure describes a coding style of the user and is derived from a number of distinct operators, a number of distinct operands, a total number of operators, and a total number of operands in connection with the one or more prior source code changes, wherein the cyclomatic complexity measure relates to a number of linearly independent paths through a unit of a project, and wherein the afferent and efferent coupling measures relate respectively to a number of other classes that reference a class and a number of other classes referenced by a class;

determining a riskiness in connection with the received source code change by measuring a deviation in the received source code change from the said measures, wherein the riskiness indicates whether the user is genuine or fraudulent; and

based on the riskiness in connection with the received source code change, controlling submission of the source code change to a source code repository such that the source code change will be submitted if the riskiness indicates that the user is genuine and will be rejected if the riskiness indicates that the user is fraudulent.

2. The method of claim 1, wherein the source code change originates from a developer workstation and is submitted to a source code repository.

3. The method of claim 1, wherein the riskiness is used to help provide an intrusion-resilient source code repository.

4. The method of claim 1, wherein determining the riskiness is based on profiling a user'"'"'s coding style based on textual clues.

5. The method of claim 1, wherein determining the riskiness is based on measuring the deviation in the change from a user'"'"'s normal coding style.

6. The method of claim 1, wherein determining the riskiness is based on measuring the deviation in the change from file types that a user typically edits.

7. The method of claim 1, wherein determining the riskiness is based on measuring the deviation in the change from a user'"'"'s typical comment style.

8. The method of claim 1, wherein determining the riskiness is based on measuring the deviation in the change from a user'"'"'s typical writing errors.

9. The method of claim 1, wherein determining the riskiness is based on measuring the deviation in the change from a user'"'"'s typical naming conventions.

10. A system for use in managing security of source code, the system comprising:

memory; and

processing circuitry coupled to the memory, the memory storing instructions which, when executed by the processing circuitry, cause the processing circuitry to;

receive, from a user, an electronic request to submit a source code change;

perform an analysis of one or more prior source code changes associated with the user to determine the user'"'"'s typical halstead complexity measure, typical cyclomatic complexity measure, typical afferent coupling measure, and typical efferent coupling measure, wherein said halstead measure describes a coding style of the user and is derived from a number of distinct operators, a number of distinct operands, a total number of operators, and a total number of operands in connection with the one or more prior source code changes, wherein the cyclomatic complexity measure relates to a number of linearly independent paths through a unit of a project, and wherein the afferent and efferent coupling measures relate respectively to a number of other classes that reference a class and a number of other classes referenced by a class;

determine a riskiness in connection with the received source code change by measuring a deviation in the received source code change from the said measures, wherein the riskiness indicates whether the user is genuine or fraudulent; and

based on the riskiness in connection with the received source code change, control submission of the source code change to a source code repository such that the source code change will be submitted if the riskiness indicates that the user is genuine and will be rejected if the riskiness indicates that the user is fraudulent.

11. The system of claim 10, wherein the source code change originates from a developer workstation and is submitted to a source code repository.

12. The system of claim 10, wherein the riskiness is used to help provide an intrusion-resilient source code repository.