International Business Machines Corporation

Richard Myer Goldberg

Jeffrey Charles Turnham

Babita Sharma

Hua Xiao

Phil S Coulthard

John Thomas Peyton, Jr

David Adiel Spriet

Zhongming Chen

Chee W Ooi

Andrew Mak

Matthew Francis Murphy

Shu Wang

Stephen Darwin Teilhet

Kristofer Alyn Duer

Allen V Chan

Allen V C Chan

Elaine Y L Lau

Elaine Yin Ling Lau

Chee Wai Ooi

Phil Coulthard

Elaine Yin Lau

Allen Vi Chan

An application analysis platform enables automatic generation of abstract program representations (APRs) that are amenable to static analyses for finding security vulnerabilities. The APR is generated automatically, preferably from an existing build system or a source repository, and then encapsulated into a binary archival format for consumption by a static analysis tool, which operates on-premises or in the cloud. The abstract program representation is a highly compact version of the actual source code it represents. The archival format obfuscates the source code that is subjected to the analysis, thus protecting it from being reverse-engineered when moved off-premises or otherwise shared with other users, teams and even organizations. Binary archive files generated separately from different source code components may be readily merged and analyzed together to provide more effective static data-flow analysis, even with respect to components that are built on different machines by different teams and at different times.

Static analysis based on abstract program representations

A selection of graphical message flow primitives defined within the message flow builder that each graphically represent and define message-oriented logic of an operation for the Web service are graphically assembled. Each graphical message flow primitive is defined within the message flow builder as a representation of a unit of work usable to define message flow patterns of Web service operation flow types and each includes a Web service operational processing logic definition of the representation of the respective unit of work usable to generate executable Web service logic. Selected ones of the graphical message flow primitives are graphically interconnected to represent a flow of messages to create a message-oriented Web service definition. The executable Web service logic defined within the message flow builder by each one of the interconnected selected graphical message flow primitives within the created message-oriented Web service definition is generated to construct the Web service.

Message oriented construction of web services

An application analysis platform enables automatic generation of abstract program representations (APRs) that are amenable to static analyzes for finding security vulnerabilities. The APR is generated automatically, preferably from an existing build system or a source repository, and then encapsulated into a binary archival format for consumption by a static analysis tool, which operates on-premises or in the cloud. The abstract program representation is a highly compact version of the actual source code it represents. The archival format obfuscates the source code that is subjected to the analysis, thus protecting it from being reverse-engineered when moved off-premises or otherwise shared with other users, teams and even organizations. Binary archive files generated separately from different source code components may be readily merged and analyzed together to provide more effective static data-flow analysis, even with respect to components that are built on different machines by different teams and at different times.

A cloud-based static analysis security tool that is accessible by a set of application development environments is augmented to provide for anonymous knowledge sharing to facilitate reducing security vulnerabilities. To the end, a crowdsourcing platform and social network are associated with the application development environments. Access to the social network platform by users of the application development environments is enabled. The anonymous access enables users to post messages without exposing sensitive data associated with a particular application development environment. As the static analysis security tool is used, a knowledgebase of information regarding identified security findings, fix priorities, and so forth, is continuously updated. Social network content (e.g., in the form of analytics, workflow recommendations, and the like) is then published from the knowledgebase to provide users with security knowledge generated by the tool from the set of application development environments. The approach provides for secure and anonymous cross-organization information sharing.

Crowd-sourced security analysis

A cloud-based static analysis security tool accessible by a set of application development environments is augmented to provide for anonymous knowledge sharing to facilitate reducing security vulnerabilities. To the end, a crowdsourcing platform and social network are associated with the application development environments. Access to the social network platform by users of the application development environments is enabled. The anonymous access enables users to post messages without exposing sensitive data associated with a particular application development environment. As the static analysis security tool is used, a knowledgebase of information regarding identified security findings, fix priorities, and so forth, is continuously updated. Social network content (e.g., in the form of analytics, workflow recommendations, and the like) is then published from the knowledgebase to provide users with security knowledge generated by the tool from the set of application development environments. The approach provides for secure and anonymous cross-organization information sharing based, for example, on analytics generated by an analytics platform.

Prioritizing security findings in a SAST tool based on historical security analysis

Embodiments of the present invention address deficiencies of the art in respect to Web services construction and provide a novel and non-obvious method, system and computer program product for message-oriented Web services construction. A method for the message oriented construction of a Web service can include graphically assembling a selection of message flow primitives defining an operation for a Web service, interconnecting selected ones of the message flow primitives to represent a flow of messages from one interconnected message flow primitive to another interconnected message flow primitive, and generating Web service logic from the selection of message flow primitives. The method further can include interpreting or executing the Web service logic in response to receiving a request to invoke the Web service.

Growing community of inventors

Thornhill, Canada

Richard Myer Goldberg