Automatic classification of security vulnerabilities in computer software applications

• US 8,806,648 B2
• Filed: 09/11/2012
• Issued: 08/12/2014
• Est. Priority Date: 09/11/2012
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Guy, Lotem, Kalman, Daniel, Tripp, Omer, Weisman, Omri
• Primary Examiner(s): SHEHNI, GHAZAL B
• Application Number:
  US13/609,320
• Publication Number:
  US 20140075560A1
• Time in Patent Office: 700 Days
• Field of Search: 726 22- 25, 713189-194
• US Class Current: 726/25
• CPC Class Codes: G06F 21/577 Assessing vulnerabilities and evaluating computer system security

Abstract

Automatically classifying security vulnerabilities in computer software applications by identifying candidate security vulnerabilities in a learning set including at least a first computer software application, classifying each of the candidate security vulnerabilities using predefined classifications, determining, for each of the candidate security vulnerabilities, values for predefined properties, creating a set of correlations between the property values and the classifications of the candidate security vulnerabilities, identifying a candidate security vulnerability in a second computer software application, determining, for the candidate security vulnerability in the second computer software application, values for the predefined properties, and using the set of correlations to classify the candidate security vulnerability in the second computer software application with a classification from the predefined classifications that best correlates with the property values of the candidate security vulnerability in the second computer software application.

Claims

1. A system for automatically classifying security vulnerabilities in computer software applications, the system comprising:

a hardware processor configured to initiate executable operations comprising;

identifying a plurality of candidate security vulnerabilities in a learning set including at least a first computer software application;

classifying each of the plurality of candidate security vulnerabilities with any classification selected from a set of predefined classifications;

determining, for each of the plurality of candidate security vulnerabilities, values for a plurality of predefined properties;

creating, for each of the plurality of candidate security vulnerabilities, a set of correlations between the values for the plurality of predefined properties and the respective classification of the candidate security vulnerability;

identifying a candidate security vulnerability in a second computer software application;

determining, for the candidate security vulnerability in the second computer software application, values for the plurality of predefined properties; and

classifying, using the set of correlations, the candidate security vulnerability in the second computer software application with a classification selected from the set of predefined classifications that best correlates with the values for the plurality of predefined properties of the candidate security vulnerability in the second computer software application.

2. The system according to claim 1 wherein creating the set of correlations by determining correlations between the values of security vulnerabilities for each of the candidate security vulnerabilities in the learning set and the classifications of the candidate security vulnerabilities in the learning set comprises:

creating the set of correlations by performing machine learning.

3. A system for automatically classifying security vulnerabilities in computer software applications comprising:

a hardware processor configured to initiate executable operations comprising;

identifying a candidate security vulnerability in a computer software application;

determining, for the candidate security vulnerability, values for a plurality of predefined properties selected from a group consisting of a number of instructions within the candidate security vulnerability, a percentage of the instructions within the candidate security vulnerability that lie within library code, a number of unique methods that are used by the instructions within the candidate security vulnerability, a number and kind of control-flow tests performed within the candidate security vulnerability, a number of taint carriers used to propagate vulnerable data within the candidate security vulnerability, a number of string manipulation statements within the candidate security vulnerability, a number of static variables through which data flow within the candidate security vulnerability, and a number of containers through which data flow within the candidate security vulnerability; and

classifying, using a set of correlations between values for the plurality of predefined properties and a set of predefined classifications of security vulnerabilities, the candidate security vulnerability with a classification selected from the set of predefined classifications of security vulnerabilities that best correlates with the values for the plurality of predefined properties of the candidate security vulnerability.

4. The system according to claim 3 wherein the hardware processor is further configured to initiate executable operations comprising:

identifying a plurality of candidate security vulnerabilities in a learning set including at least one other computer software application;

classifying each of the candidate security vulnerabilities in the learning set with any classification selected from the set of predefined classifications;

determining, for each of the candidate security vulnerabilities in the learning set, values for the plurality of predefined properties; and

creating the set of correlations by determining correlations between the values of security vulnerabilities for each of the candidate security vulnerabilities in the learning set and the classifications of the candidate security vulnerabilities in the learning set.

5. The system according to claim 4 wherein creating the set of correlations by determining correlations between the values of security vulnerabilities for each of the candidate security vulnerabilities in the learning set and the classifications of the candidate security vulnerabilities in the learning set comprises:

creating the set of correlations by performing machine learning.

6. A method for automatically classifying security vulnerabilities in computer software applications, the method comprising:

identifying a plurality of candidate security vulnerabilities in a learning set including at least a first computer software application;

classifying each of the plurality of candidate security vulnerabilities with any classification selected from a set of predefined classifications;

determining, using a hardware processor, for each of the plurality of candidate security vulnerabilities, values for a plurality of predefined properties;

creating, for each of the plurality of candidate security vulnerabilities, a set of correlations between the values for the plurality of predefined properties and the respective classification of the candidate security vulnerability;

identifying a candidate security vulnerability in a second computer software application;

determining for the candidate security vulnerability in the second computer software application, values for the plurality of predefined properties; and

classifying, using the set of correlations, the candidate security vulnerability in the second computer software application with a classification selected from the set of predefined classifications that best correlates with the values for the plurality of predefined properties of the candidate security vulnerability in the second computer software application.

7. The method according to claim 6 wherein creating the set of correlations by determining correlations between the values of security vulnerabilities for each of the candidate security vulnerabilities in the learning set and the classifications of the candidate security vulnerabilities in the learning set comprises:

creating the set of correlations by performing machine learning.

8. A method for automatically classifying security vulnerabilities in computer software applications, the method comprising:

identifying a candidate security vulnerability in a computer software application;

determining, using a hardware processor, for the candidate security vulnerability, values for a plurality of predefined properties; and

classifying, using a set of correlations between values for the plurality of predefined properties and a set of predefined classifications of security vulnerabilities, the candidate security vulnerability with a classification selected from the set of predefined classifications of security vulnerabilities that best correlates with the values for the plurality of predefined properties of the candidate security vulnerability, wherein the plurality of predefined properties are selected from a group consisting of a number of instructions within the candidate security vulnerability, a percentage of the instructions within the candidate security vulnerability that lie within library code, a number of unique methods that are used by the instructions within the candidate security vulnerability, a number and kind of control-flow tests performed within the candidate security vulnerability, a number of taint carriers used to propagate vulnerable data within the candidate security vulnerability, a number of string manipulation statements within the candidate security vulnerability, a number of static variables through which data flow within the candidate security vulnerability, and a number of containers through which data flow within the candidate security vulnerability.

9. The method according to claim 8 further comprising:

identifying a plurality of candidate security vulnerabilities in a learning set including at least one other computer software application;

classifying each of the candidate security vulnerabilities in the learning set with any classification selected from the set of predefined classifications;

determining, for each of the candidate security vulnerabilities in the learning set, values for the plurality of predefined properties; and

creating the set of correlations by determining correlations between the values of security vulnerabilities for each of the candidate security vulnerabilities in the learning set and the classifications of the candidate security vulnerabilities in the learning set.

10. The method according to claim 8 wherein creating the set of correlations by determining correlations between the values of security vulnerabilities for each of the candidate security vulnerabilities in the learning set and the classifications of the candidate security vulnerabilities in the learning set comprises:

creating the set of correlations by performing machine learning.

11. A computer program product for automatically classifying security vulnerabilities in computer software applications, the computer program product comprising:

a computer-readable storage device, wherein the computer-readable storage device is not a transitory, propagating signal, per se; and

computer-readable program code embodied in the computer-readable storage device, wherein the computer-readable program code is configured to;

identify a candidate security vulnerability in a computer software application;

determine, for the candidate security vulnerability, values for a plurality of predefined properties selected from a group consisting of a number of instructions within the candidate security vulnerability, a percentage of the instructions within the candidate security vulnerability that lie within library code, a number of unique methods that are used by the instructions within the candidate security vulnerability, a number and kind of control-flow tests performed within the candidate security vulnerability, a number of taint carriers used to propagate vulnerable data within the candidate security vulnerability, a number of string manipulation statements within the candidate security vulnerability, a number of static variables through which data flow within the candidate security vulnerability, and a number of containers through which data flow within the candidate security vulnerability; and

classifying, using a set of correlations between values of security vulnerabilities and classifications of security vulnerabilities, the candidate security vulnerability with a classification selected from the set of predefined classifications that best correlates with the values of security vulnerabilities of the candidate security vulnerability.

12. The system according to claim 11 wherein the computer-readable program code further is configured to:

identify a plurality of candidate security vulnerabilities in a learning set including at least one other computer software application;

classify each of the candidate security vulnerabilities in the learning set with any classification selected from the set of predefined classifications;

determine, for each of the candidate security vulnerabilities in the learning set, values for the plurality of predefined properties; and

create the set of correlations by determining correlations between the values of security vulnerabilities for each of the candidate security vulnerabilities in the learning set and the classifications of the candidate security vulnerabilities in the learning set.

13. The system according to claim 12 wherein the computer-readable program code is configured to create the set of correlations by performing machine learning.