Techniques for correlating vulnerabilities across an evolving codebase
View Patent ↗Methods, apparatus, and systems for characterizing vulnerabilities of an application source code are disclosed. Steps for characterizing vulnerabilities include traversing a representation of the application source code, generating a signature of a potential vulnerability of the application source code, and determining characteristics of the potential vulnerability based on a correlation between the generated signature of the potential vulnerability and previously stored signatures of potential vulnerabilities.
1. A method of characterizing vulnerabilities of application source code, comprising one or more computer processors performing steps comprising:
traversing a representation of the application source code, the representation of the application source code comprising an abstract syntax tree of the application source code;
identifying a potentially vulnerable node during traversal of the representation of the application source code;
collecting metadata of the potentially vulnerable node, the metadata comprising one or more parent or child nodes associated with the potentially vulnerable node;
generating a signature of the potentially vulnerable node, the signature comprising a value of a hash function on the metadata of the potentially vulnerable node; and
determining characteristics of a potential vulnerability associated with the potentially vulnerable node, based on a correlation between the generated signature of the potentially vulnerable node and previously stored signatures of potentially vulnerable nodes.
2. The method of claim 1 , wherein generating a signature of the potentially vulnerable node further comprises:
determining whether the potential vulnerability is associated with more than one node; and
when it is determined that the potential vulnerability is associated with more than one node, identifying a preferred node of the more than one node,
wherein collecting metadata comprises collecting metadata of the preferred node.
3. The method of claim 2 , wherein the preferred node is a last-most node.
4. The method of claim 1 , wherein collecting metadata of the potentially vulnerable node comprises:
collecting contextually significant information of all parent and children nodes of the potentially vulnerable node.
5. The method of claim 4 , wherein collecting contextually significant information comprises determining whether the potentially vulnerable node has a resolved symbol, and when it is determined that the potentially vulnerable node has a resolved symbol, collecting a corresponding qualified signature.
6. The method of claim 5 , wherein when it is determined that the potentially vulnerable node does not have a resolved symbol, a name of a node type is collected when it is determined that the node influences a control flow of the application.
7. The method of claim 1 , wherein determining characteristics of the potential vulnerability comprises:
determining whether the generated signature matches any previously stored signatures of potentially vulnerable node;
when it is determined that the generated signature matches a previously stored signature, characterizing the potentially vulnerable node having the generated signature as a duplicate; and
when it is determined that the generated signature does not match a previously stored signature, characterizing the potentially vulnerable node having the generated signature as a new vulnerability.
8. A computing system, comprising:
a storage element operable to store a representation of application source code; and
a processor operable to perform operations comprising:
traversing the representation of the application source code, the representation of the application source code comprising an abstract syntax tree of the application source code;
identifying a potentially vulnerable node during traversal of the representation of the application source code;
collecting metadata of the potentially vulnerable node, the metadata comprising one or more parent or child nodes associated with the potentially vulnerable node;
generating a signature of the potentially vulnerable node, the signature comprising a value of a hash function on the metadata of the potentially vulnerable node; and
determining characteristics of a potential vulnerability associated with the potentially vulnerable node, based on a correlation between the generated signature of the potentially vulnerable node and previously stored signatures of potentially vulnerable nodes.
9. The computing system of claim 8 , wherein generating a signature of the potentially vulnerable node further comprises:
determining whether the potential vulnerability is associated with more than one node; and
when it is determined that the potential vulnerability is associated with more than one node, identifying a preferred node of the more than one node,
wherein collecting metadata comprises collecting metadata of the preferred node.
10. The computing system of claim 8 , wherein collecting metadata of the potentially vulnerable node comprises:
collecting contextually significant information of all parent and children nodes of the potentially vulnerable node.
11. The computing system of claim 10 , wherein collecting contextually significant information comprises determining whether the potentially vulnerable node has a resolved symbol, and when it is determined that the potentially vulnerable node has a resolved symbol, collecting a corresponding qualified signature.
12. The computing system of claim 8 , wherein determining characteristics of the potential vulnerability comprises:
determining whether the generated signature matches any previously stored signatures of potentially vulnerable node;
when it is determined that the generated signature matches a previously stored signature, characterizing the potentially vulnerable node having the generated signature as a duplicate; and
when it is determined that the generated signature does not match a previously stored signature, characterizing the potentially vulnerable node having the generated signature as a new vulnerability.
13. A tangible non-transitory computer readable storage medium having code stored thereon that, when executed by a computer, causes the computer to perform operations comprising:
traversing a representation of application source code, the representation of the application source code comprising an abstract syntax tree of the application source code;
identifying a potentially vulnerable node during the traversal of the representation of the application source code;
collecting metadata of the potentially vulnerable node, the metadata comprising one or more parent or child nodes associated with the potential vulnerability;
generating a signature of the potentially vulnerable node, the signature comprising a value of a hash function on the metadata of the potentially vulnerable node; and
determining characteristics of a potential vulnerability associated with the potentially vulnerable node, based on a correlation between the generated signature of the potentially vulnerable node and previously stored signatures of potentially vulnerable nodes.
14. The storage medium of claim 13 , wherein generating a signature of the potentially vulnerable node further comprises:
determining whether the potential vulnerability is associated with more than one node; and
when it is determined that the potential vulnerability is associated with more than one node, identifying a preferred node of the more than one node,
wherein collecting metadata comprises collecting metadata of the preferred node.
15. The storage medium of claim 13 , wherein collecting metadata of the potentially vulnerable node comprises:
collecting contextually significant information of all parent and children nodes of the potentially vulnerable node.
16. The storage medium of claim 15 , wherein collecting contextually significant information comprises determining whether the potentially vulnerable node has a resolved symbol, and when it is determined that the potentially vulnerable node has a resolved symbol, collecting a corresponding qualified signature.
17. The storage medium of claim 13 , wherein determining characteristics of the potential vulnerability comprises:
determining whether the generated signature matches any previously stored signatures of potentially vulnerable node;
when it is determined that the generated signature matches a previously stored signature, characterizing the potentially vulnerable node having the generated signature as a duplicate; and
when it is determined that the generated signature does not match a previously stored signature, characterizing the potentially vulnerable node having the generated signature as a new vulnerability.