Open source vulnerability remediation tool

Patent metadata

Field	Value
Publication number	US-11308218-B2
Application number	US-201816228538-A
Country	US
Kind code	B2
Filing date	Dec 20, 2018
Priority date	Dec 20, 2018
Publication date	Apr 19, 2022
Grant date	Apr 19, 2022

Abstract

A method and system for remediating vulnerable code libraries, including open source libraries, in a software application. An application that uses code libraries and information regarding known library vulnerabilities are received, then it identifies one or more libraries in the application that are vulnerable based upon the information. For each of the one or more vulnerable libraries, a library version that minimizes risk is determined. The determined library version is incorporated into the application to form a test application, and an application test is performed on the test application. If an application test score on the test application is below a predetermined threshold, the determined library version is incorporated into a final application precursor. A final application can be determined from the final application precursor for each of the one or more vulnerable libraries.

First claim

What is claimed is:

1. A method comprising:
a) receiving, by a remediation computer, a candidate application that uses a plurality of code libraries;
b) receiving, by the remediation computer, information regarding known library vulnerabilities;
c) identifying, by the remediation computer, one or more libraries in the plurality of code libraries that are vulnerable based upon the information;
d) for each of the one or more vulnerable libraries:
i) determining a library version that minimizes risk;
ii) incorporating the determined library version that minimizes risk into the candidate application to form a test application;
iii) performing an application test on the test application;
iv) if an application test score on the test application, that incorporates the determined library version that minimizes risk, is below a predetermined threshold, then incorporating the determined library version that minimizes risk into a final application precursor; and

e) determining, by the remediation computer, in response to d), a final application.

2. The method of claim 1 , wherein performing the application test comprises:
performing one or more of a plurality of tests including exclusion testing, build testing, functional testing, regression testing, performance testing, and user interface testing.

3. The method of claim 1 , wherein the method further comprises, in d):
if the application test score is above the predetermined threshold, then generating a notification that the determined library version is not acceptable and/or selecting another library version, and repeating steps d)ii), d)iii), and d)iv).

4. The method of claim 1 , wherein the method further comprises, in d), generating an error report summarizing errors in a functionality test, wherein the error report provides change recommendations and estimated time to fix the errors.

5. The method of claim 1 , wherein determining the library version that minimizes risk comprises:
evaluating one or more of a plurality of risk factors, including known security vulnerabilities, licensing risk, and operational risk.

6. The method of claim 2 , wherein the exclusion testing comprises:
building the test application without a vulnerable library;
performing a functionality test on the test application without the vulnerable library; and
if the functionality test is below a certain threshold, then recommending removal of the vulnerable library from the candidate application.

7. The method of claim 2 , wherein the user interface testing comprises:
capturing an image of a user interface of the candidate application;
capturing an image of a user interface of the test application;
hashing the images of the user interface of the candidate application and the user interface of the test application;
comparing the hash of the image of the candidate application user interface to the hash of the image of the test application user interface; and
if the hashes do not match, then generating an intermediate remediation score based on a number of pixels that do not match.

8. The method of claim 1 , wherein the method further comprises, in d):
determining, by the remediation computer, one or more locations of a vulnerable library of the one or more vulnerable libraries in the candidate application.

9. The method of claim 8 , wherein determining, by the remediation computer, the location of the vulnerable library in the candidate application comprises determining that a vulnerability is external to the candidate application, and determining that the vulnerable library is a library that is nearest to the external vulnerability.

10. The method of claim 1 , wherein one or more of the plurality of libraries in the candidate application are open source libraries.

11. A remediation computer comprising:
a processor; and
a computer readable medium comprising code, executable by the processor, for implementing a method comprising:
a) receiving a candidate application that uses a plurality of code libraries;
b) receiving information regarding known library vulnerabilities;
c) identifying one or more libraries in the plurality of code libraries that are vulnerable based upon the information;
d) for each of the one or more vulnerable libraries:
i) determining a library version that minimizes risk;
ii) incorporating the determined library version that minimizes risk into the candidate application to form a test application;
iii) performing an application test on the test application;
iv) if an application test score on the test application, that incorporates the determined library version that minimizes risk, is below a predetermined threshold, then incorporating the determined library version that minimizes risk into a final application precursor; and

e) determining, in response to d), a final application.

12. The remediation computer of claim 11 , further comprising:
a localization module;
an application testing module;
a risk assessment module; and
an error assessment module.

13. The computer of claim 11 , wherein performing the application test comprises:
performing one or more of a plurality of tests including exclusion testing, build testing, functional testing, regression testing, performance testing, and user interface testing.

14. The computer of claim 11 , wherein the method further comprises:
if the application test score is above the predetermined threshold, then generating a notification that the determined library version is not acceptable and/or selecting another library version, and repeating steps d)ii), d)iii), and d)iv).

15. The computer of claim 11 , wherein the method further comprises, in d), generating an error report summarizing errors in a functionality test, wherein the error report provides change recommendations and estimated time to fix the errors.

16. The computer of claim 11 , wherein determining the library version that minimizes risk comprises:
evaluating one or more of a plurality of risk factors, including known security vulnerabilities, licensing risk, and operational risk.

17. The computer of claim 13 , wherein the exclusion testing comprises:
building the test application without a vulnerable library;
performing a functionality test on the test application without the vulnerable library; and
if the functionality test is below a certain threshold, then recommending removal of the vulnerable library from the candidate application.

18. The computer of claim 13 , wherein the user interface testing comprises:
capturing an image of a user interface of the candidate application;
capturing an image of a user interface of the test application;
hashing the images of the user interface of the candidate application and the user interface of the test application;
comparing the hash of the image of the candidate application user interface to the hash of the image of the test application user interface; and
if the hashes do not match, then generating an intermediate remediation score based on a number of pixels that do not match.

19. The computer of claim 11 , wherein the method further comprises, in d):
determining, by the remediation computer, a location of a vulnerable library of the one or more vulnerable libraries in the candidate application.

20. The computer of claim 19 , wherein determining the location of the vulnerable library in the candidate application comprises determining a vulnerability is external to the candidate application, and determining that the vulnerable library is a library that i

Assignees

• Visa Int Service Ass

Inventors

• Nagaraja Vinjith
• Brammer Raymond
• Myers James
• Gutierrez Christopher
• Pazdzierniak Ireneusz
• Jiang Shanshan
• Mawani Karim
• Rathore Pankaj
• Wald Jerry
• Worth David
• Vig Dhruv
• Taparia Archana
• Chifamba Robert
• Ramarapu Vamshi

Classifications

• G06F11/3698

  Environments for analysis, debugging or testing of software · CPC title

• G06F11/3696

  Methods or tools to render software testable · CPC title

• G06F11/3688

  for test execution, e.g. scheduling of test suites · CPC title

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F11/3684

  for test design, e.g. generating new test cases · CPC title