Detecting and mitigating application security threats based on threat change patterns

A method comprising:

• executing a static security model to analyze each of a group of the development code sets to detect a number of corresponding threat objects in each development code set;
• determining whether the number of the threat objects detected in each of the group of the development code sets is lower than a static threat threshold;
• in response to determining that the number of the threat objects in each of the group of the development code sets is lower than the static threat threshold, run an application;
• in conjunction with running the application, executing a run-time security model to determine a set of threat object measurements for a plurality of application product releases for the application;
• determining a set of threat change ratios of the application product releases for the application based on a first threat object measurement and the threat object measurements after the first threat object measurement;
• determining a threat change pattern of the set of threat change ratios associated with the application product releases for the application;
• and
• determining, based at least in part upon the threat change pattern, whether to trigger a development security model for the application.

A non-transitory computer-readable medium storing instructions that when executed by a processor, cause the processor to:

• execute a static security model to analyze each of the group of a development code sets to detect a number of corresponding threat objects in each development code set;
• determine whether the number of the threat objects detected in each of the group of the development code sets is lower than a static threat threshold;
• in response to determining that the number of the threat objects in each of the group of the development code sets is lower than the static threat threshold, run an application;
• in conjunction with running the application, execute a run-time security model to determine a set of threat object measurements for a plurality of application product releases for the application;
• determine a set of threat change ratios of the application product releases for the application based on a first threat object measurement and the threat object measurements after the first threat object measurement;
• determine a threat change pattern of the set of threat change ratios associated with the application product releases for the application;
• and
• determine, based at least in part upon the threat change pattern, whether to trigger a development security model for the application.