Detecting vulnerabilities associated with a software application build

Patent metadata

Field	Value
Publication number	US-10691810-B1
Application number	US-201916572405-A
Country	US
Kind code	B1
Filing date	Sep 16, 2019
Priority date	Sep 16, 2019
Publication date	Jun 23, 2020
Grant date	Jun 23, 2020

Abstract

Methods and apparatuses are described for detecting vulnerabilities associated with a software application build. A server generates a software application build based upon a source code repository, including determining application dependencies of the software application build. The server identifies vulnerabilities associated with the application dependencies. For each identified vulnerability, the server creates an aspect class based upon a package file associated with the vulnerability, the aspect class comprising vulnerability logging code. The server integrates the created aspect classes into libraries of the application dependencies, generates a new package file based upon the application dependencies, and integrates the new package file into the software application build. The server executes the software application build, including generating log statements by calling the aspect classes in the new package file. The server analyzes the log statements to determine which of the identified vulnerabilities were invoked during execution of the software application build.

First claim

What is claimed is:

1. A system for detecting vulnerabilities associated with a software application build, the system comprising:
a server computing device with a memory for storing computer-executable instructions and a processor that executes the computer-executable instructions to:
generate a software application build based upon a source code repository, including determining one or more application dependencies of the software application build;
identify one or more vulnerabilities associated with the one or more application dependencies, including:
generating a vulnerability database comprised of an aggregation of a plurality of software vulnerabilities extracted from two or more different vulnerability data sources,
scanning source code in the software application build using the vulnerability database to detect one or more vulnerabilities,
determining characteristics of each detected vulnerability, the characteristics including a group identifier, an artifact identifier, a version number, a type, a severity level, a pointcut definition, and a location in the source code, and
updating the vulnerability database to include the determined characteristics for each detected vulnerability;

for each identified vulnerability, create an aspect class based upon a package file associated with the vulnerability, the aspect class comprising vulnerability logging code based upon the pointcut definition for the vulnerability;
integrate the created aspect classes into one or more libraries of the one or more application dependencies;
generate a new package file for each of at least one of the one or more application dependencies;
integrate the new package files into the software application build;
execute the software application build, including generating one or more log statements by calling one or more of the aspect classes in the new package files; and
analyze the one or more log statements generated by the one or more aspect classes to determine which of the identified vulnerabilities were invoked during execution of the software application build, including:
extracting vulnerability information from the one or more log statements,
parsing the extracted vulnerability information to determine a development entity that manages source code associated with the extracted vulnerability information,
generating one or more vulnerability warning messages based upon the extracted vulnerability information and the determined development entity, and
transmitting the vulnerability warning messages to a user device associated with the determined development entity.

2. The system of claim 1 , wherein the software application build is a Java application build.

3. The system of claim 1 , wherein determining one or more application dependencies of the software application build comprises storing the determined application dependencies in an output file.

4. The system of claim 1 , wherein the one or more application dependencies are Java Archive (JAR) files.

5. The system of claim 1 , wherein the identified one or more vulnerabilities comprise a file name of a JAR file, a Java class name, a Java method name, or any combination thereof.

6. The system of claim 1 , wherein identifying one or more vulnerabilities associated with the one or more application dependencies comprises accessing a remote database to retrieve an identity of one or more of the vulnerabilities.

7. The system of claim 6 , wherein the vulnerabilities database is located in a local data store coupled to the server computing device.

8. The system of claim 1 , wherein the aspect class is a Java Aspect class and the vulnerability logging code is Advice code.

9. The system of claim 8 , wherein the Advice code includes one or more pointcut expressions that each generates a log statement comprising a package name and a method name that contain the Advice code.

10. The system of claim 1 , wherein the new package file is a JAR file that includes the created aspect classes.

11. The system of claim 10 , wherein integrating the new package file into the software application build comprises:
modifying a build configuration file of the software application build to include the new package file as a dependency to the software application build; and
re-running the software application build using the modified build configuration file to generate an updated software application build that includes the new package file.

12. The system of claim 1 , wherein when the server computing device executes the software application build, the generated one or more log statements are transmitted to a remote computing device, which analyzes the one or more log statements generated by the one or more aspect classes.

13. The system of claim 12 , wherein the remote computing device generates a vulnerability remediation ticket in a software application development system based upon the analysis of the one or more log statements.

14. A computerized method of detecting vulnerabilities associated with a software application build, the method comprising:
generating, by a server computing device, a software application build based upon a source code repository, including determining one or more application dependencies of the software application build;
identifying, by the server computing device, one or more vulnerabilities associated with the one or more application dependencies, including:
generating a vulnerability database comprised of an aggregation of a plurality of software vulnerabilities extracted from two or more different vulnerability data sources,
scanning source code in the software application build using the vulnerability database to detect one or more vulnerabilities,
determining characteristics of each detected vulnerability, the characteristics including a group identifier, an artifact identifier, a version number, a type, a severity level, a pointcut definition, and a location in the source code, and
updating the vulnerability database to include the determined characteristics for each detected vulnerability;

for each identified vulnerability, creating, by the server computing device, an aspect class based upon a package file associated with the vulnerability, the aspect class comprising vulnerability logging code based upon the pointcut definition for the vulnerability;
integrating, by the server computing device, the created aspect classes into one or more libraries of the one or more application dependencies;
generating, by the server computing device, a new package file for each of at least one of the one or more application dependencies;
integrating, by the server computing device, the new package files into the software application build;
executing, by the server computing device, the software application build, including generating one or more log statements by calling one or more of the aspect classes in the new package files; and
analyzing, by the server computing device, the one or more log statements generated by the one or more aspect classes to determine which of the identified vulnerabilities were invoked during execution of the software application build, including:
extracting vulnerability information from the one or more log statements,
parsing the extracted vulnerability information to determine a development entity that manages source code associated with the extracted vulnerability information,
generating one or more vulnerability warning messages based upon the extracted vulnerability information and the determined development entity, and
transmitting the vulnerability warning messages to a user device associated with the determined development

Assignees

• Fmr Llc

Inventors

• Freitag Jon Augustine
• Yarman Joseph Scott
• Shih Stuart Te-Hui

Classifications

• G06F8/71

  Version control (security arrangements therefor G06F21/57); Configuration management · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F21/54

  by adding security routines or objects to programs · CPC title

• G06F8/65

  Updates (security arrangements therefor G06F21/57) · CPC title

• G06F2221/033

  Test or assess software · CPC title