System and method for application security profiling
A system and method for application security profiling that includes extracting a code property graph from at least a subset of a code base; generating a code profile from the code property graph, wherein generating the code profile occurs prior to a compilation of the code base; and applying the code profile, comprising of identifying sections of interest within the code base.
1. A method for application security profiling comprising of:
creating a code policy, wherein the policy is a formal specification for generating a code profile;
extracting a code property graph from at least a subset of a code base, wherein extracting the code property graph comprises of:
extracting an abstract syntax tree subcomponent,
extracting a control flow graph subcomponent,
extracting a property graph subcomponent, and
forming a joint data structure of the three subcomponents such that each subcomponent has a node for each subject and predicate of the base code;
generating a code profile from the code property graph and the code policy, thereby:
identifying interface channels, wherein interface channels characterize input/output associated operations of the code base,
classifying data types and functions,
characterizing code based dependencies, by tracing a flow of data using a data flow graph,
characterizing exposed interfaces of the code base, by tracing the flow of interfaces using the control flow graph, and
wherein generating the code profile occurs prior to a compilation of the code base; and
applying the code profile, comprising of identifying sections of interest within the code base.
2. The method of claim 1 , wherein extracting the code property graph further comprises of initially extracting the abstract syntax tree subcomponent, the control flow graph subcomponent, and the data flow graph subcomponent from the code base.
3. The method of claim 1 , wherein extracting the code property graph further comprises of maintaining the code property graph with changes to the code base.
4. The method of claim 1 , wherein creating the code policy comprises of receiving user input specifying at least a portion of the code policy.
5. The method of claim 1 , wherein creating the code policy comprises of iteratively applying an application security profiling method to the code base.
6. The method of claim 5 , wherein iteratively applying the method comprises of applying the method to lower level dependencies of the code base.
7. The method of claim 1 , wherein classifying data types comprises of classifying sensitive data.
8. The method of claim 1 , wherein classifying data types comprises of classifying attacker controlled data and unvalidated user data.
9. The method of claim 1 , wherein generating the code profile further comprises of traversing the code profile graph and identifying flows between various points of the code base.
10. The method of claim 1 , wherein extracting a code property graph further comprises of extracting a code property graph from a subset of multiple code bases.
11. The method of claim 10 , wherein generating a code profile further comprises of generating a code profile for a subset of multiple code bases.
12. The method of claim 1 , wherein extracting a code property graph further comprises parallelizing computation of the code property graph across multiple computational nodes.
13. The method of claim 1 , wherein applying the code profile occurs prior to application runtime.
14. The method of claim 1 , wherein applying the code profile further comprises of generating a code profile report.
15. The method of claim 1 , wherein applying the code profile further comprises of augmenting the development process of the code base by implementing code specific recommendations from the code profile.
16. The method of claim 1 , wherein applying the code profile further comprises of implementing a dynamic code-specific runtime agent.
17. A method for application security profiling comprising of:
creating a code policy, wherein the code policy is a formal specification for generating a code profile;
extracting a code property graph from a subset of a code base, wherein extracting a code property graph comprises of:
extracting an abstract syntax tree subcomponent,
extracting a control flow graph subcomponent,
extracting a property graph subcomponent, and
forming a joint data structure of the three subcomponents such that each subcomponent has a node for each subject and predicate of the code base;
generating the code profile, by traversing the code property graph and using the code policy, thereby:
identifying interface channels, wherein interface channels characterize input/output associated operations of the code base,
classifying data types and functions,
characterizing code based dependencies, by tracing a flow of data using a data flow graph,
characterizing exposed interfaces of the code base, by tracing the flow of interfaces using the control flow graph, and
wherein generating the code profile occurs prior to a compilation of the code base; and
applying the code profile, comprising of identifying locations of interest within the code base.
18. The method of claim 17 , wherein generating the code profile further comprises of implementing specifications of the code policy into at least one of the code profile subcomponents, thereby generating a code profile that comprises of subcomponents and flow interactions of interest.