Assessing vulnerability impact using call graphs

A non-transitory computer-readable storage medium coupled to one or more processors and having instructions stored thereon which, when executed by the one or more processors, cause the one or more processors to perform operations for enhancing assessment of vulnerability of an application program based on call graphs, the operations comprising:

• receiving a complete call graph that is provided by static source code analysis (SSCA) of the application program and any third-party libraries used by the application;
• receiving one or more stack traces that are provided based on dynamic source code analysis (DSCA) during execution of the application program;
• processing the complete call graph, the one or more stack traces, and vulnerable function data to provide one or more combined call graphs, the vulnerable function data identifying one or more vulnerable functions included in the one or more third-party libraries, each combined call graph being specific to a respective vulnerable function, the processing comprising:
• determining a unique identifier assigned to a vulnerable function from the vulnerable function data;
• providing a sub-call graph based on the unique identifier at least in part by searching from a node representing the vulnerable function backward within the complete call graph to identify one or more nodes representing functions of one or more of the third-party libraries and the application program to provide a sub-set of nodes from the complete call graph, the sub-set of nodes and relations between nodes defining the sub-call graph;
• identifying a stack trace associated with the unique identifier;
• and merging the stack trace with the sub-call graph to provide a combined call graph for the vulnerable function;
• and
• providing a graphical representation of each combined call graph.

A system, comprising:

• a computing device;
• and
• a computer-readable storage device coupled to the computing device and having instructions stored thereon which, when executed by the computing device, cause the computing device to perform operations for enhancing assessment of vulnerability of an application program based on call graphs, the operations comprising:
• receiving a complete call graph that is provided by static source code analysis (SSCA) of the application program and any third-party libraries used by the application;
• receiving one or more stack traces that are provided based on dynamic source code analysis (DSCA) during execution of the application program;
• processing the complete call graph, the one or more stack traces, and vulnerable function data to provide one or more combined call graphs, the vulnerable function data identifying one or more vulnerable functions included in the one or more third-party libraries, each combined call graph being specific to a respective vulnerable function, the processing comprising:
• determining a unique identifier assigned to a vulnerable function from the vulnerable function data;
• providing a sub-call graph based on the unique identifier at least in part by searching from a node representing the vulnerable function backward within the complete call graph to identify one or more nodes representing functions of one or more of the third-party libraries and the application program to provide a sub-set of nodes from the complete call graph, the sub-set of nodes and relations between nodes defining the subcall graph;
• identifying a stack trace associated with the unique identifier;
• and merging the stack trace with the sub-call graph to provide a combined call graph for the vulnerable function;
• and
• providing a graphical representation of each combined call graph.