Solution-centric reporting of security warnings
First Claim
1. A method of automated analysis on source files of a software system, comprising:
- performing a set of operations in an automated manner during a static analysis of the source files performed by a security scanner, the operations comprising;
receiving sets of trace data each representing a potential security flaw in the software system, the trace data comprising a set of trace nodes;
parsing the sets of trace data by vulnerability type;
analyzing the sets of trace data to identify a solution group comprising trace nodes that exist across the sets of trace data;
processing the trace nodes in the solution group by iterating through the trace data and counting occurrences of a trace node to identify a reduced set of common nodes representing one or more potential fix points for a security flaw, the reduced set of common nodes including a most common node that is closest to a sink without being the sink, the one or more potential fix points having associated therewith a recommendation for addressing the security flaw;
configuring the one or more potential fix points as an application programming interface (API) to which a sanitization or validation routine is configured to be coupled to attempt to address the security flaw.
2 Assignments
0 Petitions
Accused Products
Abstract
A new paradigm for security analysis is provided by transitioning code analysis reporting from the problem space (the warnings themselves), to a solution space (potential solutions to the identified problems). Thus, instead of reporting raw findings to the user, the automated system as described here outputs proposed solutions to eliminate the defects identified in the security analysis. A consequence of this approach is that the report generated by the analysis tool is much more consumable, and thus much more actionable. Preferably, the report provides the user with one or more candidate location(s) at which to apply a fix to an identified security problem. These locations preferably are identified by processing overlapping nodes to identify one or more solution groupings that represent an API for a sanitization fix. The report also includes one or more recommendations for the fix, and preferably the report is generated on a per-vulnerability type basis.
-
Citations
15 Claims
-
1. A method of automated analysis on source files of a software system, comprising:
performing a set of operations in an automated manner during a static analysis of the source files performed by a security scanner, the operations comprising; receiving sets of trace data each representing a potential security flaw in the software system, the trace data comprising a set of trace nodes; parsing the sets of trace data by vulnerability type; analyzing the sets of trace data to identify a solution group comprising trace nodes that exist across the sets of trace data; processing the trace nodes in the solution group by iterating through the trace data and counting occurrences of a trace node to identify a reduced set of common nodes representing one or more potential fix points for a security flaw, the reduced set of common nodes including a most common node that is closest to a sink without being the sink, the one or more potential fix points having associated therewith a recommendation for addressing the security flaw; configuring the one or more potential fix points as an application programming interface (API) to which a sanitization or validation routine is configured to be coupled to attempt to address the security flaw. - View Dependent Claims (2, 3, 4, 5)
-
6. Apparatus, comprising:
-
a processor; computer memory holding computer program instructions executed by the processor to perform automated analysis on source files of a software system, the computer program instructions operative in an automated matter during a static analysis of the source files performed by a security scanner to; receive sets of trace data each representing a potential security flaw in the software system, the trace data comprising a set of trace nodes; parse the sets of trace data by vulnerability type; analyze the sets of trace data to identify a solution group comprising trace nodes that exist across the sets of trace data; process the trace nodes in the solution group by iterating through the trace data and counting occurrences of a trace node to identify a reduced set of common nodes representing one or more potential fix points for a security flaw, the reduced set of common nodes including a most common node that is closest to a sink without being the sink, the one or more potential fix points having associated therewith a recommendation for addressing the security flaw; and configure the one or more potential fix points as an application programming interface (API) to which a sanitization or validation routine is configured to be coupled to attempt to address the security flaw. - View Dependent Claims (7, 8, 9, 10)
-
-
11. A computer program product in a non-transitory computer readable medium for use in a data processing system, the computer program product holding computer program instructions executed by the data processing system to perform automated analysis on source files of a software system, the computer program instructions operative in an automated matter during a static analysis of the source files performed by a security scanner to:
-
receive sets of trace data each representing a potential security flaw in the software system, the pathway data comprising a set of trace nodes; parse the sets of trace data by vulnerability type; analyze the sets of trace data to identify a solution group comprising trace nodes that exist across the sets of trace data; process the trace nodes in the solution group by iterating through the trace data and counting occurrences of a trace node to identify a reduced set of common nodes representing one or more potential fix points for a security flaw, the reduced set of common nodes including a most common node that is closest to a sink without being the sink, the one or more potential fix points having associated therewith a recommendation for addressing the security flaw; and configure the one or more potential fix points as an application programming interface (API) to which a sanitization or validation routine is configured to be coupled to attempt to address the security flaw. - View Dependent Claims (12, 13, 14, 15)
-
Specification