Using static analysis for vulnerability detection

1. A method of using static analysis for vulnerability detection, the method comprising:

inspecting, using an underapproximate static code analysis, a non-executable representation of an application to identify one or more vulnerabilities in the application, wherein the underapproximate static code analysis is a static code analysis limited to realizable flows in the application, wherein inspecting the non-executable representation of the application comprises:

identifying one or more realizable flows in the application using a taint analysis; and

analyzing only the one or more realizable flows in the application identified using the taint analysis to identify the one or more vulnerabilities; and

providing an indication of the one or more vulnerabilities.

2. The method of claim 1 , wherein the taint analysis is based on one or more of symbolic execution or incorrectness logic.

3. The method of claim 1 , wherein providing an indication of the one or more vulnerabilities comprises presenting a graph visualization based on the one or more vulnerabilities.

4. The method of claim 2 , wherein a severity of an anomaly indicated in the graph visualization is based on a vulnerability corresponding to the anomaly being identified by the underapproximate static code analysis.

5. The method of claim 1 , wherein the indication of the one or more vulnerabilities comprises an alert.

6. The method of claim 5 , wherein the alert is presented during a stage of a continuous integration/continuous deployment (CI/CD) pipeline prior to an execution of the application.

7. A system for using static analysis for vulnerability detection, the system comprising:

a memory;

a processing device operatively coupled to the memory, the processing device configured to:

inspect, using an underapproximate static code analysis, a non-executable representation of an application to identify one or more vulnerabilities in the application, wherein the underapproximate static code analysis is a static code analysis limited to realizable flows in the application, wherein inspecting the non-executable representation of the application comprises:

identifying one or more realizable flows in the application using a taint analysis; and

analyzing only the one or more realizable flows in the application identified using the taint analysis to identify the one or more vulnerabilities; and

provide an indication of the one or more vulnerabilities.

8. The system of claim 7 , wherein the taint analysis is based on one or more of symbolic execution or incorrectness logic.

9. The system of claim 7 , wherein, to provide an indication of the one or more vulnerabilities, the processing device is further configured to present a graph visualization based on the one or more vulnerabilities.

10. The system of claim 9 , wherein a severity of an anomaly indicated in the graph visualization is based on a vulnerability corresponding to the anomaly being identified by the underapproximate static code analysis.

11. The system of claim 7 , wherein the indication of the one or more vulnerabilities comprises an alert.

12. The system of claim 11 , wherein the alert is presented during a stage of a continuous integration/continuous deployment (CI/CD) pipeline prior to an execution of the application.

13. A method of using static analysis for vulnerability detection, the method comprising:

detecting, using data generated by monitoring an execution of a cloud deployment, an anomaly associated with the cloud deployment;

modifying a severity of the anomaly based on a static code analysis; and

presenting a graph visualization for the cloud deployment based on the severity of the anomaly.

14. The method of claim 13 , wherein the severity of the anomaly is based on an accessibility of a code path associated with a vulnerability.

15. The method of claim 13 , wherein the severity of the anomaly is based on a probability of execution of a component comprising a vulnerability.

16. The method of claim 15 , wherein the severity of the anomaly is further based on a type of exploit for the vulnerability.

17. The method of claim 13 , wherein presenting the polygraph for the cloud deployment comprises including, in the graph visualization, an indication of the anomaly based on the severity of the anomaly.

18. The method of claim 13 , wherein presenting the polygraph for the cloud deployment comprises excluding, from the graph visualization, an indication of the anomaly based on the severity of the anomaly.