Techniques for correlating vulnerabilities across an evolving codebase

1. A method of correlating vulnerabilities across an evolving codebase, comprising:

generating a representation of computer code, the representation different from the computer code;

identifying a potential vulnerability during traversal of the representation of the computer code;

collecting metadata of the potential vulnerability;

generating a unique vulnerability signature of the potential vulnerability by hashing the metadata of the potential vulnerability;

correlating the unique vulnerability signature of the potential vulnerability and previously stored vulnerability signatures of potential vulnerabilities to reduce duplicate potential vulnerabilities during the traversal; and

determining characteristics of the potential vulnerability based on the correlation.

2. The method of claim 1 , wherein collecting metadata of the potential vulnerability comprises collecting contextually significant information of the potential vulnerability.

3. The method of claim 2 , wherein collecting contextually significant information comprises:

determining whether the potential vulnerability has a resolved symbol; and

in response to determining that the potential vulnerability has a resolved symbol, collecting a corresponding qualified signature.

4. The method of claim 2 , wherein collecting contextually significant information comprises:

determining whether the potential vulnerability has a resolved symbol; and

in response to determining that the potential vulnerability does not have a resolved symbol, determining that a construct of the representation of computer code influences control flow of the computer code.

5. The method of claim 1 , wherein the correlating further comprises:

determining whether the unique vulnerability signature matches any previously stored signatures of potential vulnerability;

in response to determining that the unique vulnerability signature matches a previously stored signature, characterizing the potential vulnerability as a duplicate; and

removing the potential vulnerability.

6. The method of claim 1 , wherein the correlating further comprises:

determining whether the unique vulnerability signature matches any previously stored signatures of potential vulnerability;

in response to determining that the unique vulnerability does not match a previously stored signature, characterizing the potential as a new vulnerability.

7. The method of claim 1 , wherein the representation of the computer code is an abstract syntax tree.

8. A system of correlating vulnerabilities across an evolving codebase, comprising:

a processor; and

a memory comprising instructions that when executed by the processor, causes the processor to:

generate a representation of computer code, the representation different from the computer code;

identify a potential vulnerability during traversal of the representation of the computer code;

collect metadata of the potential vulnerability;

generate a unique vulnerability signature of the potential vulnerability by hashing the metadata of the potential vulnerability;

correlate the unique vulnerability signature of the potential vulnerability and previously stored vulnerability signatures of potential vulnerabilities to reduce duplicate potential vulnerabilities during the traversal; and

determine characteristics of the potential vulnerability based on the correlation.

9. The system of claim 8 , comprising further instructions, which when executed by the processor causes the processor to collect contextually significant information of the potential vulnerability.

10. The system of claim 9 , comprising further instructions, which when executed by the processor causes the processor to:

determine whether the potential vulnerability has a resolved symbol; and

in response to the determination that the potential vulnerability has a resolved symbol, collect a corresponding qualified signature.

11. The system of claim 9 , comprising further instructions, which when executed by the processor causes the processor to:

determine whether the potential vulnerability has a resolved symbol; and

in response to the determination that the potential vulnerability does not have a resolved symbol, determine that a construct of the representation of computer code influences control flow of the computer code.

12. The system of claim 8 , comprising further instructions, which when executed by the processor causes the processor to:

determine whether the unique vulnerability signature matches any previously stored signatures of potential vulnerability;

in response to the determination that the unique vulnerability signature matches a previously stored signature, characterize the potential vulnerability as a duplicate; and

remove the potential vulnerability.

13. The system of claim 8 , comprising further instructions, which when executed by the processor causes the processor to:

determine whether the unique vulnerability signature matches any previously stored signatures of potential vulnerability;

in response to the determination that the unique vulnerability does not match a previously stored signature, characterize the potential as a new vulnerability.

14. The system of claim 8 , wherein the representation of the computer code is an abstract syntax tree.

15. A non-transitory computer readable medium storing instructions that when executed by a processor cause the processor to:

generate a representation of computer code, the representation different from the computer code;

identify a potential vulnerability during traversal of the representation of the computer code;

collect metadata of the potential vulnerability;

generate a unique vulnerability signature of the potential vulnerability by hashing the metadata of the potential vulnerability;

correlate the unique vulnerability signature of the potential vulnerability and previously stored vulnerability signatures of potential vulnerabilities to reduce duplicate potential vulnerabilities during the traversal; and

determine characteristics of the potential vulnerability based on the correlation.

16. The non-transitory computer readable medium of claim 15 , comprising further instructions, which when executed by the processor causes the processor to collect contextually significant information of the potential vulnerability.

17. The non-transitory computer readable medium of claim 16 , comprising further instructions, which when executed by the processor causes the processor to:

determine whether the potential vulnerability has a resolved symbol; and

in response to the determination that the potential vulnerability has a resolved symbol, collect a corresponding qualified signature.

18. The non-transitory computer readable medium of claim 16 , comprising further instructions, which when executed by the processor causes the processor to:

determine whether the potential vulnerability has a resolved symbol; and

in response to the determination that the potential vulnerability does not have a resolved symbol, determine that a construct of the representation of computer code influences control flow of the computer code.

19. The non-transitory computer readable medium of claim 15 , comprising further instructions, which when executed by the processor causes the processor to:

determine whether the unique vulnerability signature matches any previously stored signatures of potential vulnerability;

in response to the determination that the unique vulnerability signature matches a previously stored signature, characterize the potential vulnerability as a duplicate; and

remove the potential vulnerability.

20. The non-transitory computer readable medium of claim 15 , comprising further instructions, which when executed by the processor causes the processor to:

determine whether the unique vulnerability signature matches any previously stored signatures of potential vulnerability;

in response to the determination that the unique vulnerability does not match a previously stored signature, characterize the potential as a new vulnerability.