Rule-based system and method for detecting and identifying tampering in security analysis of source code

1. A method for analyzing a security scanning analysis for source code in a computing resource to detect an alteration event in the security scanning analysis, the method comprising:

receiving, by an alteration event processor, the security scanning analysis for the computing resource;

parsing data, by the alteration event processor, from a plurality of fields in the security scanning analysis;

analyzing the parsed data, by the alteration event processor, to detect whether the security scanning analysis includes an alteration event;

determining, by the alteration event processor, that the security scanning analysis includes the alteration event; and

linking, by the alteration event processor, the alteration event with the computing resource before the computing resource is made available to a client device in a network,

wherein the analyzing the parsed data comprises one or more of:

a) receiving a total lines scanned value from the parsed data, and comparing the total lines scanned value to a line number threshold to detect the alteration event,

b) receiving a total files scanned value from the parsed data, and comparing the total files scanned value to a file number threshold to detect the alteration event,

c) receiving at least one of the total lines scanned value and the total files scanned value from the parsed data, accessing at least one of total lines scanned data and total files scanned data in a field in the security scanning analysis, and comparing the total lines scanned value or the total files scanned value to the total lines scanned data or the total files scanned data, respectively, to detect the alteration event, and

d) receiving a total findings value from the parsed data, and comparing the total findings value to a breakdown of one or more security scan results in the security scanning analysis to detect the alteration event,

e) receiving an excluded findings value from the parsed data, and comparing the excluded findings value to an exceptions threshold to detect the alteration event, and

f) checking data in each exclusion field in the security scanning analysis, and detecting the alteration event based on the checked data comprising an exclusion attribute, wherein the exclusion attribute includes a TRUE setting.

2. The method of claim 1 , wherein the analyzing the parsed data comprises:

receiving a date value from the parsed data;

comparing the date value to a threshold value to detect the alteration event.

3. The method of claim 1 , wherein the analyzing the parsed data comprises:

receiving summary data from the parsed data; and

comparing the summary data to a breakdown of one or more security scan results in the security scanning analysis to detect the alteration event.

4. The method of claim 1 , wherein the analyzing the parsed data comprises:

receiving a vulnerability frequency value from the parsed data;

retrieving vulnerability frequency data from a field in the security scanning analysis; and

comparing the vulnerability frequency value to the vulnerability frequency data in the security scanning analysis to detect the alteration event.

5. The method of claim 1 , wherein the analyzing the parsed data comprises:

receiving a vulnerability density value from the parsed data;

retrieving vulnerability density data from a field in the security scanning analysis; and

comparing the vulnerability density value to the vulnerability density data in the security scanning analysis to detect the alteration event.

6. A system that analyzes a security scanning analysis for source code in a computing resource to detect an alteration event in the security scanning analysis, the system comprising:

an alteration event processor that:

receives the security scanning analysis for the computing resource;

parses security scan results data from a plurality of fields in the security scanning analysis;

analyzes the security scan results data;

detects whether the security scanning analysis includes an alteration event;

generates alteration event data for a detected alteration event; and

links the alteration event data with the computing resource before the computing resource is made available to a client device in a network,

wherein the alteration event processor comprises one or more of:

a line number comparator that receives a total lines scanned value from the parsed data and compares the total lines scanned value to a line number threshold or data in a field in the security scanning analysis to detect the alteration event,

a field number comparator that receives a total fields scanned value from the parsed data and compares the total files scanned value to a file number threshold or data in a field in the security scanning analysis to detect the alteration event,

a vulnerability sum determiner that receives a total findings value from the parsed data and compares the total findings value to a breakdown of one or more security scan results in the security scanning analysis to detect the alteration event, and

an exceptions determiner that receives an excluded findings value from the parsed data or that checks data in each exclusion field in the security scanning analysis, wherein the exceptions determiner compares the excluded findings value to an exceptions threshold or detects an exclusion attribute to detect the alteration event, and wherein the exclusion attribute is set to TRUE.

7. The system of claim 6 , wherein the alteration event processor comprises a date comparator that receives a date value from the parsed data and compares the date value to a threshold value to detect the alteration event.

8. The system of claim 6 , wherein the alteration event processor comprises a sum-type comparator that receives summary data from the parsed data and compares the summary data to a breakdown of one or more security scan results in the security scanning analysis to detect the alteration event.

9. The system of claim 6 , wherein the alteration event processor comprises a vulnerability frequency comparator that receives a vulnerability frequency value from the parsed data and compares the vulnerability frequency value to vulnerability frequency data in a field in the security scanning analysis to detect the alteration event.

10. The system of claim 6 , wherein the alteration event processor comprises a vulnerability density comparator that receives a vulnerability density value from the parsed data and compares the vulnerability density value to vulnerability density data in a field in the security scanning analysis to detect the alteration event.