Reporting security vulnerability warnings
View Patent ↗A computer-implemented method, computer program product, and computing system is provided for reporting security vulnerabilities. In an embodiment, a method may include receiving a set of potential security vulnerabilities associated with a program. The method may also include filtering the set of potential security vulnerabilities by eliminating one or more spurious security vulnerabilities to generate a set of likely security vulnerabilities. The method may further include consolidating the set of likely security vulnerabilities into one or more solution categories, each of the one or more solutions categories defining a solution for remedying each of the likely security vulnerabilities within the solution category.
1. A computer-implemented method comprising:
receiving, by a processor, a set of potential security vulnerabilities associated with a program;
filtering, by the processor, the set of potential security vulnerabilities by eliminating one or more spurious security vulnerabilities to generate a set of likely security vulnerabilities; and
consolidating, by the processor, the set of likely security vulnerabilities into one or more solution categories, each of the one or more solutions categories defining a code modification for remedying each of the likely security vulnerabilities within the solution category, wherein combining both filtering and consolidation steps results in the reduction of the total number of the received set of potential security vulnerabilities.
2. The computer-implemented method of claim 1 , wherein receiving the set of potential security vulnerabilities associated with the program includes conducting a static analysis of source code associated with the program.
3. The computer-implemented method of claim 1 , wherein receiving the set of potential security vulnerabilities associated with the program includes conducting dynamic analysis of the program.
4. The computer-implemented method of claim 1 , wherein filtering the set of potential security vulnerabilities includes pre-filtering the set of potential security vulnerabilities based upon, at least in part, an established set of heuristics for removing known patterns of false positives.
5. The computer-implemented method of claim 1 , wherein filtering the set of potential security vulnerabilities applies statistical learning and user feedback to identify false positive potential security vulnerabilities.
6. The computer-implemented method of claim 1 , wherein consolidating the set of likely security vulnerabilities into one or more solution categories includes analyzing each likely security vulnerability to identify an issue type associated with each likely security vulnerability.
7. The computer-implemented method of claim 1 , wherein consolidating the set of likely security vulnerabilities into one or more solution categories includes analyzing each likely security vulnerability to identify code locations associated with each likely security vulnerability.
8. A computer program product comprising a non-transitory computer readable storage medium having a plurality of instructions stored thereon, which, when executed by a processor, cause the processor to perform operations including:
receiving a set of potential security vulnerabilities associated with a program;
filtering the set of potential security vulnerabilities by eliminating one or more spurious security vulnerabilities to generate a set of likely security vulnerabilities; and
consolidating the set of likely security vulnerabilities into one or more solution categories, each of the one or more solutions categories defining a code modification for remedying each of the likely security vulnerabilities within the solution category, wherein combining both filtering and consolidation steps results in the reduction of the total number of the received set of potential security vulnerabilities.
9. The computer program product of claim 8 , wherein receiving the set of potential security vulnerabilities associated with the program includes conducting a static analysis of source code associated with the program.
10. The computer program product of claim 8 , wherein receiving the set of potential security vulnerabilities associated with the program includes conducting dynamic analysis of the program.
11. The computer program product of claim 8 , wherein filtering the set of potential security vulnerabilities includes pre-filtering the set of potential security vulnerabilities based upon, at least in part, an established set of heuristics for removing known patterns of false positives.
12. The computer program product of claim 8 , wherein filtering the set of potential security vulnerabilities applies statistical learning and user feedback to identify false positive potential security vulnerabilities.
13. The computer program product of claim 8 , wherein consolidating the set of likely security vulnerabilities into one or more solution categories includes analyzing each likely security vulnerability to identify an issue type associated with each likely security vulnerability.
14. The computer program product of claim 8 , wherein consolidating the set of likely security vulnerabilities into one or more solution categories includes analyzing each likely security vulnerability to identify code locations associated with each likely security vulnerability.
15. A computing system comprising:
a processor and a memory module coupled with the processor, the processor being configured for:
receiving a set of potential security vulnerabilities associated with a program;
filtering the set of potential security vulnerabilities by eliminating one or more spurious security vulnerabilities to generate a set of likely security vulnerabilities; and
consolidating the set of likely security vulnerabilities into one or more solution categories, each of the one or more solutions categories defining a code modification for remedying each of the likely security vulnerabilities within the solution category, wherein combining both filtering and consolidation steps results in the reduction of the total number of the received set of potential security vulnerabilities.
16. The computing system of claim 15 , wherein receiving the set of potential security vulnerabilities associated with the program includes conducting a static analysis of source code associated with the program.
17. The computing system of claim 15 , wherein receiving the set of potential security vulnerabilities associated with the program includes conducting dynamic analysis of the program.
18. The computing system of claim 15 , wherein filtering the set of potential security vulnerabilities includes pre-filtering the set of potential security vulnerabilities based upon, at least in part, an established set of heuristics for removing known patterns of false positives.
19. The computing system of claim 15 , wherein filtering the set of potential security vulnerabilities applies statistical learning and user feedback to identify false positive potential security vulnerabilities.
20. The computing system of claim 15 , wherein consolidating the set of likely security vulnerabilities into one or more solution categories includes analyzing each likely security vulnerability to identify an issue type associated with each likely security vulnerability.
21. The computing system of claim 15 , wherein consolidating the set of likely security vulnerabilities into one or more solution categories includes analyzing each likely security vulnerability to identify code locations associated with each likely security vulnerability.