Techniques for correlating vulnerabilities across an evolving codebase
Methods, apparatus, and systems for characterizing vulnerabilities of an application source code are disclosed. Steps for characterizing vulnerabilities include traversing a representation of the application source code, generating a signature of a potential vulnerability of the application source code, and determining characteristics of the potential vulnerability based on a correlation between the generated signature of the potential vulnerability and previously stored signatures of potential vulnerabilities.
1. A method of correlating vulnerabilities across an evolving codebase, comprising:
obtaining a representation of source code of the evolving codebase;
scanning the representation to identity one or more potential vulnerabilities;
identifying one or more potential vulnerabilities;
generating a signature for each of the one or more potential vulnerabilities;
storing the signature in a repository, wherein the repository stores a plurality of signatures from previous scans of one or more versions of the source code of the evolving codebase;
comparing the signature with the plurality of signatures from previous scans;
in response to a match between the signature and the plurality of signatures, determining the signature as a duplicate; and
determining one or more characteristics of the one or more potential vulnerabilities.
2. The method of claim 1 , further comprising:
in response to no match between the signature and the plurality of signatures, determining the signature is a new vulnerability and storing the signature in the repository.
3. The method of claim 1 , further comprising:
determining, during the scan, a number of occurrences of the one or more potential vulnerabilities in the representation of the source code; and
determining, a preferred occurrence of the number of occurrences of the one or more potential vulnerabilities.
4. The method of claim 1 , wherein the signature is generated from contextual information of the one or more potential vulnerabilities.
5. The method of claim 1 , wherein the signature is generated from hashing contextual information of the one or more potential vulnerabilities.
6. The method of claim 1 , further comprising:
comparing each of the plurality of signatures from previous scans with each of the one or more potential vulnerabilities; and
in response, to no match for a previous signature of the plurality of signatures, determining the corresponding vulnerability to the previous signature has been fixed.
7. The method of claim 1 , wherein the one or more characteristics identify newly found potential vulnerabilities or identify fixed or removed potential vulnerabilities.
8. A non-transitory computer-readable medium storing instructions, which when executed by a processor, causes the processor to:
obtain a representation of source code of the evolving codebase;
scan the representation to identity one or more potential vulnerabilities;
identify one or more potential vulnerabilities;
generate a signature for each of the one or more potential vulnerabilities;
store the signature in a repository, wherein the repository stores a plurality of signatures from previous scans of one or more versions of the source code of the evolving codebase;
compare the signature with the plurality of signatures from previous scans;
in response to a match between the signature and the plurality of signatures, determine the signature as a duplicate; and
determine one or more characteristics of the one or more potential vulnerabilities.
9. The non-transitory computer-readable medium of claim 8 , storing further instructions, which when executed by the processor, causes the processor to:
in response to no match between the signature and the plurality of signatures, determine the signature is a new vulnerability and storing the signature in the repository.
10. The non-transitory computer-readable medium of claim 8 , storing further instructions, which when executed by the processor, causes the processor to:
determine, during the scan, a number of occurrences of the one or more potential vulnerabilities in the representation of the source code; and
determine, a preferred occurrence of the number of occurrences of the one or more potential vulnerabilities.
11. The non-transitory computer-readable medium of claim 8 , wherein the signature is generated from contextual information of the one or more potential vulnerabilities.
12. The non-transitory computer-readable medium of claim 8 , wherein the signature is generated from hashing contextual information of the one or more potential vulnerabilities.
13. The non-transitory computer-readable medium of claim 8 , storing further instructions, which when executed by the processor, causes the processor to:
compare each of the plurality of signatures from previous scans with each of the one or more potential vulnerabilities; and
in response, to no match for a previous signature of the plurality of signatures, determine the corresponding vulnerability to the previous signature has been fixed.
14. The non-transitory computer-readable medium of claim 8 , wherein the one or more characteristics identify newly found potential vulnerabilities or identify fixed or removed potential vulnerabilities.
15. A system correlating vulnerabilities across an evolving codebase, the system comprising:
a processor; and
a memory storing instructions, which when executed by the processor, causes the processor to:
obtain a representation of source code of the evolving codebase;
scan the representation to identity one or more potential vulnerabilities;
identify one or more potential vulnerabilities;
generate a signature for each of the one or more potential vulnerabilities;
store the signature in a repository, wherein the repository stores a plurality of signatures from previous scans of one or more versions of the source code of the evolving codebase;
compare the signature with the plurality of signatures from previous scans;
in response to a match between the signature and the plurality of signatures, determine the signature as a duplicate; and
determine one or more characteristics of the one or more potential vulnerabilities.
16. The system of claim 15 , storing further instructions which when executed by the processor, causes the processor to:
in response to no match between the signature and the plurality of signatures, determine the signature is a new vulnerability and storing the signature in the repository.
17. The system of claim 15 , storing further instructions, which when executed by the processor, causes the processor to:
determine, during the scan, a number of occurrences of the one or more potential vulnerabilities in the representation of the source code; and
determine, a preferred occurrence of the number of occurrences of the one or more potential vulnerabilities.
18. The system of claim 15 , wherein the signature is generated from contextual information of the one or more potential vulnerabilities.
19. The system of claim 15 , wherein the signature is generated from hashing contextual information of the one or more potential vulnerabilities.
20. The system of claim 15 , storing further instructions, which when executed by the processor, causes the processor to:
compare each of the plurality of signatures from previous scans with each of the one or more potential vulnerabilities; and
in response, to no match for a previous signature of the plurality of signatures, determine the corresponding vulnerability to the previous signature has been fixed.
21. The system of claim 15 , wherein the one or more characteristics identify newly found potential vulnerabilities or identify fixed or removed potential vulnerabilities.