Applying machine learning techniques to discover security impacts of application programming interfaces
A computer-implemented method includes obtaining, by a processor, existing security information for static application security testing (SAST). The method also includes using, by the processor, the existing security information to discover, by a machine capable of learning, new security information. The method also includes improving, by the processor, security of a computer using the new security information.
1. A computer-implemented method of improving security of a tangible computer, the method comprising:
training, by the processor, a machine learning algorithm by providing to the machine learning algorithm known security information placed on currently understood second APIs in a plurality of application programming interfaces (APIs);
normalizing, by a processor, the plurality of application programming interfaces (APIs) to form a plurality of normalized APIs, wherein the plurality of APIs include first APIs with unknown security information;
analyzing, by the processor using the machine learning algorithm, the plurality of normalized APIs by identifying a subset of the plurality of APIs that have semantics of a feature, wherein the feature is selected from the group consisting of a source, a sink, and a taint propagator;
performing, by the processor, static analysis security testing only on the subset of the plurality of APIs;
identifying, by the processor, a compromised API from the subset of the plurality of APIs using the static analysis security testing;
improving, by the processor, security of the computer by taking an action on the computer as a result of identifying the compromised API; and
automatically marking-up, by the processor, the subset of the plurality of APIs, wherein marking-up highlights sources of taint, sinks, and taint propagators.
2. A computer-implemented method of improving security of a tangible computer, the method comprising:
training, by the processor, a machine learning algorithm by providing to the machine learning algorithm known security information placed on currently understood second APIs in a plurality of application programming interfaces (APIs);
normalizing, by a processor, the plurality of application programming interfaces (APIs) to form a plurality of normalized APIs, wherein the plurality of APIs include first APIs with unknown security information;
analyzing, by the processor using the machine learning algorithm, the plurality of normalized APIs by identifying a subset of the plurality of APIs that have semantics of a feature, wherein the feature is selected from the group consisting of a source, a sink, and a taint propagator;
performing, by the processor, static analysis security testing only on the subset of the plurality of APIs;
identifying, by the processor, a compromised API from the subset of the plurality of APIs using the static analysis security testing;
improving, by the processor, security of the computer by taking an action on the computer as a result of identifying the compromised API;
wherein:
the source comprises an entry point of one of untrusted or user controlled data into a particular API;
the sink comprises an exit point of untrusted data in original form from the particular API;
the taint propagator comprises a pathway through which malicious data flows through a system;
the source comprises a query string from a uniform resource locator request;
the sink comprises a database execute query call using untrusted data as an argument of the database execute query call; and
the taint propagator comprises a “string.append”.
3. A computer program product for improving security of a tangible computer, the computer program product comprising a computer readable storage medium having program instructions embodied therewith, the program instructions executable by a processor to cause the processor to:
training, by the processor, a machine learning algorithm by providing to the machine learning algorithm known security information placed on currently understood second APIs in plurality of application programming interfaces (APIs);
normalize the plurality of application programming interfaces (APIs) to form a plurality of normalized APIs, wherein the plurality of APIs include first APIs with unknown security information;
analyze, using a machine learning algorithm, the plurality of normalized APIs by identifying a subset of the plurality of APIs that have semantics of a feature, wherein the feature is selected from the group consisting of a source, a sink, and a taint propagator;
perform static analysis security testing only on the subset of the plurality of APIs;
identify a compromised API from the subset of the plurality of APIs using the static analysis security testing;
improve security of the computer by taking an action on the computer as a result of identifying the compromised API; and
automatically mark-up the subset of the plurality of APIs, wherein marking-up highlights sources of taint, sinks, and taint propagators.