International Business Machines Corporation

John Thomas Peyton, Jr

Kristofer Alyn Duer

Babita Sharma

Omer Tripp

Stephen Darwin Teilhet

Jeffrey Charles Turnham

Jason N Todd

Iosif Viorel Onut

Shu Wang

Paul Ionescu

Wayne Duncan Smith

Nevon C Brake

Richard Myer Goldberg

Hua Xiao

Matthew Francis Murphy

David E Stewart

Andrew Mak

Marco Pistoia

Ryan Berg

Shay Artzi

Manu Sridharan

Robert Wiener

Ettore Merlo

Mathieu Merineau

Jonathan J Butler

A computer-implemented method includes obtaining, by a processor, existing security information for static application security testing (SAST). The method also includes using, by the processor, the existing security information to discover, by a machine capable of learning, new security information. The method also includes improving, by the processor, security of a computer using the new security information.

Applying machine learning techniques to discover security impacts of application programming interfaces

A computer-implemented method for security scanning application code includes executing, via a processor, a full scan of the application code and generating a program intermediate representation (IR) and a list of security findings determined by the full scan. The processor executes an incremental scan of the application code after at least one change to the application code, and identifies at least one changed file in the application code. The processor then generates an incremental intermediate representation (IR) based at least in part on the at least one changed file. The processor merges the saved scan state and the incremental IR, produces a merged scan state, and outputs security findings based at least in part on the merged scan state and the incremental IR.

Scan time reduction in application code security scanning

A static analysis tool is augmented to provide a mechanism by which a large set (and potentially all) security warnings output from the tool may be represented to the user in a manner that is manageable for consumption by the user. According to this disclosure, a static analysis is run on a program to generate a set of security warnings. Using dynamic programming, the set of security warnings output by the static analysis are mapped onto a collection of fix points, wherein a fix point captures a location within the program that should be visited to fix a set of warnings that map to that fix point. The fix points represent the highest probable locations of particular potential vulnerabilities in the program. They are computed in a parametric manner, preferably according to user preferences, by solving an instance of a 'knapsack' problem.

Consolidating static analysis tool warnings using dynamic programming

An application analysis platform enables automatic generation of abstract program representations (APRs) that are amenable to static analyses for finding security vulnerabilities. The APR is generated automatically, preferably from an existing build system or a source repository, and then encapsulated into a binary archival format for consumption by a static analysis tool, which operates on-premises or in the cloud. The abstract program representation is a highly compact version of the actual source code it represents. The archival format obfuscates the source code that is subjected to the analysis, thus protecting it from being reverse-engineered when moved off-premises or otherwise shared with other users, teams and even organizations. Binary archive files generated separately from different source code components may be readily merged and analyzed together to provide more effective static data-flow analysis, even with respect to components that are built on different machines by different teams and at different times.

Static analysis based on abstract program representations

A new paradigm for security analysis is provided by transitioning code analysis reporting from the problem space (the warnings themselves), to a solution space (potential solutions to the identified problems). Thus, instead of reporting raw findings to the user, the automated system as described here outputs proposed solutions to eliminate the defects identified in the security analysis. A consequence of this approach is that the report generated by the analysis tool is much more consumable, and thus much more actionable. Preferably, the report provides the user with one or more candidate location(s) at which to apply a fix to an identified security problem. These locations preferably are identified by processing overlapping nodes to identify one or more solution groupings that represent an API for a sanitization fix. The report also includes one or more recommendations for the fix, and preferably the report is generated on a per-vulnerability type basis.

Solution-centric reporting of security warnings

An application analysis platform enables automatic generation of abstract program representations (APRs) that are amenable to static analyzes for finding security vulnerabilities. The APR is generated automatically, preferably from an existing build system or a source repository, and then encapsulated into a binary archival format for consumption by a static analysis tool, which operates on-premises or in the cloud. The abstract program representation is a highly compact version of the actual source code it represents. The archival format obfuscates the source code that is subjected to the analysis, thus protecting it from being reverse-engineered when moved off-premises or otherwise shared with other users, teams and even organizations. Binary archive files generated separately from different source code components may be readily merged and analyzed together to provide more effective static data-flow analysis, even with respect to components that are built on different machines by different teams and at different times.

A computer-implemented method, computer program product, and computing system is provided for reporting security vulnerabilities. In an embodiment, a method may include receiving a set of potential security vulnerabilities associated with a program. The method may also include filtering the set of potential security vulnerabilities by eliminating one or more spurious security vulnerabilities to generate a set of likely security vulnerabilities. The method may further include consolidating the set of likely security vulnerabilities into one or more solution categories, each of the one or more solutions categories defining a solution for remedying each of the likely security vulnerabilities within the solution category.

Reporting security vulnerability warnings

Verifying application security vulnerabilities includes receiving a source code to analyze, performing a static analysis using the received source code and generating a vulnerability call trace for the received source code. Responsive to a determination that all static analysis results are not validated, mock objects are generated using the vulnerability call trace and a unit test is created using the generated mock objects. The unit test is executed using the generated mock objects and responsive to a determination that an identified vulnerability was validated; a next static analysis result is selected. Responsive to a determination that all static analysis results are validated, results and computed unit tests are reported.

Verifying application security vulnerabilities

Systems and methods are provided for creating a data structure associated with a software application that is based on at least one framework. According to the method, source code and at least one configuration file of the software application is analyzed by at least one framework-specific processor so as to determine entry point information indicating entry points in the source code, request attribute access information indicating where attributes attached to a request data structure are read and written, and forward information indicating forwards performed by the software application. A data structure for a static analysis engine is created based on this information. The data structure includes a list of synthetic methods that model framework-related behavior of the software application, and a list of entry points indicating the synthetic methods and/or application methods of the software application that can be invoked by the framework.

Growing community of inventors

Arlington, MA, United States of America

John Thomas Peyton, Jr