International Business Machines Corporation

Jeffrey Charles Turnham

Babita Sharma

Richard Myer Goldberg

David Kenneth McKnight

John Thomas Peyton, Jr

Hua Xiao

Rhonda L Childress

Iosif Viorel Onut

Paul Ionescu

Michael Hanner

Sharon Hagi

Andrew Mak

Matthew Francis Murphy

Shu Wang

Guy Podjarny

Stephen Darwin Teilhet

Kristofer Alyn Duer

Jason N Todd

Ashish Patel

Robert S Cecco

Ettore Merlo

Robert Calendino

Craig Ronald Earl Conboy

Mathieu Merineau

Embodiments include method, systems and computer program products for automatic detection of an incomplete static analysis security assessment. In some embodiments, a method includes obtaining component versioning data associated with a build of an application. The method further includes determining, using the component versioning data associated with the build of the application, that a static analysis security assessment configuration of the application is incomplete. The method further includes, responsive to determining that the static analysis security assessment configuration of the application is incomplete, generating metadata indicating that at least a portion of the build of the application has been changed from a previous build of the application.

Automatic detection of an incomplete static analysis security assessment

A method, system and computer-usable medium for generating a security analysis effort, cost and process scope estimates, comprising: analyzing a software system; identifying a complexity level of a security analysis, the complexity level of the security analysis comprising identification of an effort level for the security analysis; and, generating the security analysis effort estimate, the security analysis effort estimate comprising an estimate of an effort expenditure to perform a security analysis on the software system at the identified complexity level.

Machine learning statistical methods estimating software system's security analysis assessment or audit effort, cost and processing decisions

A computer-implemented method for security scanning application code includes executing, via a processor, a full scan of the application code and generating a program intermediate representation (IR) and a list of security findings determined by the full scan. The processor executes an incremental scan of the application code after at least one change to the application code, and identifies at least one changed file in the application code. The processor then generates an incremental intermediate representation (IR) based at least in part on the at least one changed file. The processor merges the saved scan state and the incremental IR, produces a merged scan state, and outputs security findings based at least in part on the merged scan state and the incremental IR.

Scan time reduction in application code security scanning

An application analysis platform enables automatic generation of abstract program representations (APRs) that are amenable to static analyses for finding security vulnerabilities. The APR is generated automatically, preferably from an existing build system or a source repository, and then encapsulated into a binary archival format for consumption by a static analysis tool, which operates on-premises or in the cloud. The abstract program representation is a highly compact version of the actual source code it represents. The archival format obfuscates the source code that is subjected to the analysis, thus protecting it from being reverse-engineered when moved off-premises or otherwise shared with other users, teams and even organizations. Binary archive files generated separately from different source code components may be readily merged and analyzed together to provide more effective static data-flow analysis, even with respect to components that are built on different machines by different teams and at different times.

Static analysis based on abstract program representations

An application analysis platform enables automatic generation of abstract program representations (APRs) that are amenable to static analyzes for finding security vulnerabilities. The APR is generated automatically, preferably from an existing build system or a source repository, and then encapsulated into a binary archival format for consumption by a static analysis tool, which operates on-premises or in the cloud. The abstract program representation is a highly compact version of the actual source code it represents. The archival format obfuscates the source code that is subjected to the analysis, thus protecting it from being reverse-engineered when moved off-premises or otherwise shared with other users, teams and even organizations. Binary archive files generated separately from different source code components may be readily merged and analyzed together to provide more effective static data-flow analysis, even with respect to components that are built on different machines by different teams and at different times.

A cloud-based static analysis security tool that is accessible by a set of application development environments is augmented to provide for anonymous knowledge sharing to facilitate reducing security vulnerabilities. To the end, a crowdsourcing platform and social network are associated with the application development environments. Access to the social network platform by users of the application development environments is enabled. The anonymous access enables users to post messages without exposing sensitive data associated with a particular application development environment. As the static analysis security tool is used, a knowledgebase of information regarding identified security findings, fix priorities, and so forth, is continuously updated. Social network content (e.g., in the form of analytics, workflow recommendations, and the like) is then published from the knowledgebase to provide users with security knowledge generated by the tool from the set of application development environments. The approach provides for secure and anonymous cross-organization information sharing.

Crowd-sourced security analysis

A cloud-based static analysis security tool accessible by a set of application development environments is augmented to provide for anonymous knowledge sharing to facilitate reducing security vulnerabilities. To the end, a crowdsourcing platform and social network are associated with the application development environments. Access to the social network platform by users of the application development environments is enabled. The anonymous access enables users to post messages without exposing sensitive data associated with a particular application development environment. As the static analysis security tool is used, a knowledgebase of information regarding identified security findings, fix priorities, and so forth, is continuously updated. Social network content (e.g., in the form of analytics, workflow recommendations, and the like) is then published from the knowledgebase to provide users with security knowledge generated by the tool from the set of application development environments. The approach provides for secure and anonymous cross-organization information sharing based, for example, on analytics generated by an analytics platform.

Prioritizing security findings in a SAST tool based on historical security analysis

A computer implemented method, a data processing system, and a computer usable recordable-type medium having a computer usable program code monitor a black box web application security scan. A black box scan of a web application is initiated. The black box scan sends a test is sent to a plurality of web application inputs of the web application. A runtime analysis is performed on the black box scan of the web application. Based on the run time analysis of the black box scan, the black box scan is modified.

Measuring coverage of application inputs for advanced web application security testing

A system and method for integrating command shell into a graphical user interface (GUI) in order to provide a single user interface (UI), so that a user need not work in different environments for different tasks are provided. An output response from the command shell is typically one or more lines of text from an output stream such as standard error or standard output. To accomplish the integration, a user is enabled to enter shell commands from the GUI. Output responses from the commands are interpreted to determine how to represent objects in the responses. The interpretation may be by pattern matching with regular expressions. If a shell command produces lines of command output, which when interpreted (e.g. indicating a file or folder), map to some other object model (e.g. a file subsystem) in the GUI, appropriate model objects (e.g., a file or folder icon) are created and rendered into the GUI as a response to the shell command.

System and method for object-oriented graphically integrated command shell

A dynamic generic framework for distributed tooling comprising a system for creating, storing and manipulating objects, which includes a datastore, a user interface and tools. In a distributed or client-server environment, a virtual datastore is created on the client, through which updates to the user interface and commands to the tools are routed. Commands and updates are transmitted asynchronously through handlers. The objects in the datastore are all of the same kind and have a predetermined generic or uniform attribute set. The schema is comprised of schema objects in the datastore which schema objects are dynamically created by the tools. The user interface perceives and comprehends the schema and utilizes the schema to identify and display objects in the datastore, the relationships therebetween, and the commands that can be executed thereon.

Dynamic generic framework for distributed tooling

A system and method for parsing source code written in a high-level programming language at multiple levels may be performed to populate a tree data structure. To obtain information at lower levels, higher levels are parsed. Each level of parsing is performed as a separate stage with the results of higher levels being used to feed parsing at lower levels. The system and method of the present invention provide for parsing at a requested level, not parsing to a lower level than requested.

Growing community of inventors

Newmarket, Canada

Jeffrey Charles Turnham