Automated security analysis of software libraries
AssigneeWells Fargo Bank, N.A.
InventorsJeremy W. Long, Mitch Moon
Life of this patent
Estimating the term…
Abstract
A method for identifying security vulnerabilities in a third party software component includes generating a test application for the third party software component. The test application is generated such that every externally accessible data path in the third party component is called. The test application and the third party software component are analyzed using a static application security testing (SAST) code analyzer. One or more test results are obtained from the SAST code analyzer. The one or more test results are used to identify security vulnerabilities in the third party component.
Claims18
A method for identifying security vulnerabilities in a software library, the method comprising:
- generating a test application for the software library;
- identifying methods and functions used in the software library;
- using the test application to implement a method call or a function call for each identified method and function, respectively, in the software library;
- analyzing the test application and the software library in a static application security testing (SAST) code analyzer, the analyzing of the test application and the software library in the SAST code analyzer comprising identifying a plurality of software entry points in the software library;
- obtaining one or more test results from the SAST code analyzer, wherein the one or more test results include manual test results in which one or more individuals have identified false positives;
- using the manual test results to identify security vulnerabilities in the software library;
- and
- using one of the manual test results to generate custom rules used when testing new applications that use the software library, wherein the custom rules are automatically generated by a custom rules generator, and wherein the custom rules model a behavior of a third party component and include passing tainted data from the test application to the software library.
A method for identifying security vulnerabilities in a software library, the method comprising:
- generating a test application for the software library;
- identifying methods and functions used in the software library;
- using the test application to implement a method call or a function call for each identified method and function, respectively, in the software library;
- analyzing the test application and the software library in a static application security testing (SAST) code analyzer, the analyzing of the test application and the software library in the SAST code analyzer comprising:
- identifying a plurality of software entry points in the software library;
- and
- providing tainted data to the software entry points;
- obtaining one or more test results from the SAST code analyzer, wherein the one or more test results include manual test results in which one or more individuals have identified false positives;
- using the manual results to identify security vulnerabilities in the software library;
- and
- using one of the manual results to generate custom rules used when testing new applications that use the software library, wherein the custom rules are automatically generated by a custom rules generator, and wherein the custom rules model a behavior of a third party component and include passing tainted data from the test application to the software library.
A method for identifying security vulnerabilities in a third party software component, the method comprising:
- generating a test application for the third party software component;
- identifying each method and function used in the third party software component;
- using the test application to implement a method call or a function call for each identified method and function, respectively, in the third party software component;
- analyzing the test application and the third party software component in a static application security testing (SAST) code analyzer, the analyzing of the test application and the software library in the SAST code analyzer comprising identifying a plurality of software entry points in the third party software component;
- obtaining one or more test results from the SAST code analyzer, wherein the one or more test results include manual test results in which one or more individuals have identified false positives;
- using the manual test results to identify security vulnerabilities in the third party software component;
- and
- using the manual test results to generate custom rules used when testing new applications that use the third party software component, wherein the custom rules are automatically generated by a custom rules generator, and wherein the custom rules model a behavior of a third party component and include passing tainted data from the test application to the software library.
Dependencies are inferred from the claim text.