US 2014/0373159 A1Published application

After-The-Fact Configuration Of Static Analysis Tools Able To Reduce User Burden

AssigneeInternational Business Machines Corporation

InventorsSalvatore A. Guarnieri, Marco Pistoia, Omer Tripp

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method includes mapping, based on a first mapping from possible security findings to possible configuration-related sources of imprecision, actual security findings from a static analysis of a program to corresponding configuration-related sources of imprecision, the mapping of the actual security findings creating a second mapping. A user is requested to configure selected ones of the configuration-related sources of imprecision from the second mapping. Responsive to a user updating configuration corresponding to the selected ones of the configuration-related sources of imprecision, security analysis results are updated for the static analysis of the program at least by determining whether one or more security findings from the security analysis results are no longer considered to be vulnerable based on the updated configuration by the user. The updated security analysis results are output. Apparatus and program products are also disclosed.

Claims20

Dependent claims

An apparatus, comprising:

one or more memories comprising computer-readable code;
one or more processors,
wherein the one or more processors are configured, in response to execution of the computer-readable code, to cause the apparatus to perform the following:
mapping, based on a first mapping from possible security findings to possible configuration-related sources of imprecision, actual security findings from a static analysis of a program to corresponding configuration-related sources of imprecision, the mapping of the actual security findings creating a second mapping;
requesting a user configure selected ones of the configuration-related sources of imprecision from the second mapping;
responsive to a user updating configuration corresponding to the selected ones of the configuration-related sources of imprecision, updating security analysis results for the static analysis of the program at least by determining whether one or more security findings from the security analysis results are no longer considered to be vulnerable based on the updated configuration by the user;
and
outputting the updated security analysis results.

5 more elements

A computer program product comprising a non-transitory computer readable storage medium having program code embodied therewith, the program code executable by a computing system causing the computing system to perform:

mapping, based on a first mapping from possible security findings to possible configuration-related sources of imprecision, actual security findings from a static analysis of a program to corresponding configuration-related sources of imprecision, the mapping of the actual security findings creating a second mapping;
requesting a user configure selected ones of the configuration-related sources of imprecision from the second mapping;
responsive to a user updating configuration corresponding to the selected ones of the configuration-related sources of imprecision, updating security analysis results for the static analysis of the program at least by determining whether one or more security findings from the security analysis results are no longer considered to be vulnerable based on the updated configuration by the user;
and
outputting the updated security analysis results.

2 more elements

Dependencies are inferred from the claim text.