Back to results
US 11,687,657 B2Granted
Systems and methods for software security analysis
AssigneeCodeLogic, Inc.
InventorSoumik Sarkar
Life of this patent
Estimating the term…
Abstract
A security analysis of software includes analyzing security risks at each level of the hierarchy of the software and aggregating identified risks within the hierarchy levels. Weights applied during aggregation assist in homogenizing risk scores originating from different types of identified security risks and provide for the ability to communicate a meaningful risk score at each level of the hierarchy.
Claims23
A computer-implemented method for analyzing software dependencies, comprising:
- on a first asset, executing a technology agent configured to:
- analyze software stored in memory of the first asset, the analysis comprising:
- identifying nodes within the software,
- recording a hierarchy of the nodes within the software,
- identifying any dependencies within the software and with other portions of software;
- and
- on the first asset, executing a security agent configured to:
- analyze security of the software stored in the memory of the first asset, the security analysis comprising:
- identifying security risks in the software and assigning a risk level to each,
- associating each identified security risk with a node or edge, and
- aggregating security risks at at least two different levels of the software hierarchy into hierarchy level risk scores by first applying weights to the risk levels and then adding the weighted risk levels of identified security risks associated with nodes or edges within the levels,
- wherein:
- the security analysis further comprises identifying a frequency of modifications made to each of a plurality of nodes, and
- a modification frequency weight is applied that increases with a higher frequency of modifications identified for a particular node.
11 more elements
A computer-implemented method for analyzing software dependencies, comprising:
- on a first asset, executing a technology agent configured to:
- analyze software stored in memory of the first asset, the analysis comprising:
- identifying nodes within the software,
- recording a hierarchy of the nodes within the software,
- identifying any dependencies within the software and with other portions of software;
- and
- on the first asset, executing a security agent configured to:
- analyze security of the software stored in the memory of the first asset, the security analysis comprising:
- identifying security risks in the software, including by identifying dependencies that traverse a DMZ policy and identifying a security risk for each such traversal, and assigning a risk level to each,
- associating each identified security risk with a node or edge, and
- aggregating security risks at at least two different levels of the software hierarchy into hierarchy level risk scores by adding risk levels of identified security risks associated with nodes or edges within the levels.
8 more elements
Dependencies are inferred from the claim text.