Back to results
US 11,687,658 B2Granted
Software code vulnerability remediation
AssigneeCapital One Services, LLC
InventorsSteven Dang, Chih-Hsiang Chow, Elizabeth Furlan
Life of this patent
Estimating the term…
Abstract
Systems and methods automating the process of application code vulnerability remediation. Implementations include building a repository of code revisions as software is checked for security vulnerabilities using or more software analysis tools. In certain implementations, historical code revisions are cataloged and stored in the repository. The revisions may be tokenized and utilized to detect and automatically remediate similar issues when new software packages are submitted to the system.
Claims17
A system for tokenizing software code security vulnerabilities and remediating matching vulnerabilities in application code, the system comprising:
- one or more processors;
- memory in communication with the one or more processors and storing instructions that, when executed by the one or more processors, cause the system to:
- receive initial vulnerability listings responsive to submissions of one or more initial code packages to one or more software security analysis tools;
- receive subsequent vulnerability listings responsive to actual or potential remediations of the one or more initial code packages by the one or more software security analysis tools;
- generate differential listings comprising vulnerability remediation updates to the one or more initial code packages by the one or more software security analysis tools;
- generate one or more generalized remediation tokens for each of the vulnerability remediation updates identified in the differential listings;
- determine similarities among the generalized remediation tokens;
- pool similar generalized remediation tokens;
- store the pooled similar generalized remediation tokens in a repository;
- revise at least one previously generated generalized remediation token based on the determined similarities;
- receive an application code package;
- locate one or more fields of the application code package that include a vulnerability comprising a syntax error defined by one or more of the generalized remediation tokens;
- and
- automatedly remediate, using the one or more fields, the vulnerability in the application code package.
11 more elements
A method for automated remediation of application code using tokenized software code security vulnerabilities, the method comprising:
- receiving an application code package;
- identifying one or more fields of the application code package having a syntax error that correspond to a generalized remediation token, comprising:
- locating one or more fields of the application code package that include a security vulnerability defined by one or more generalized remediation tokens, wherein the one or more generalized remediation tokens are determined by:
- receiving initial vulnerability listings responsive to submissions of one or more initial code packages to one or more software security analysis tools;
- receiving subsequent vulnerability listings responsive to actual or potential remediations of the one or more initial code packages by the one or more software security analysis tools;
- generating one or more differential listings comprising vulnerability remediation updates to the one or more initial code packages by the one or more software security analysis tools;
- and
- generating a generalized remediation token for each of the vulnerability remediation updates identified in the differential listings;
- determining similarities among the generalized remediation tokens;
- pooling similar generalized remediation tokens;
- storing the pooled similar generalized remediation tokens in a repository;
- revising at least one previously generated generalized remediation token based on the determined similarities;
- outputting for review by a user, one or more options for remediation of the of the one or more fields of the application code package;
- and
- responsive to a selection of the one or more options, automatically applying remediation of the one or more fields of the application code package using the generalized remediation token according to a selected option.
12 more elements
A non-transitory computer readable storage medium storing instructions that are configured to cause one or more processors to:
- receive initial vulnerability listings responsive to submissions of one or more initial code packages to one or more software security analysis tools;
- receive subsequent vulnerability listings responsive to actual or potential remediations of the one or more initial code packages by the one or more software security analysis tools;
- generate differential listings comprising vulnerability remediation updates to the one or more initial code packages by the one or more software security analysis tools;
- generate a generalized remediation token for each of the vulnerability remediation updates identified in the differential listings;
- determine similarities among the generalized remediation tokens;
- pool similar generalized remediation tokens;
- store the pooled similar generalized remediation tokens in a repository;
- revise at least one previously generated generalized remediation token based on the determined similarities;
- receive an application code package;
- locate one or more fields of the application code package that include a security vulnerability comprising a syntax error defined by one or more of the generalized remediation tokens;
- output for review by a user, a menu of one or more options for remediation of the of the one or more fields of the application code package;
- and
- remediate the one or more fields of the application code package automatically according to a selected option using remediation updates associated with the one or more generalized remediation tokens.
10 more elements
Dependencies are inferred from the claim text.