System, method, and non-transitory computer-readable storage media for analyzing software application modules and provide actionable intelligence on remediation efforts

Patent metadata

Field	Value
Publication number	US-9594913-B2
Application number	US-201514607855-A
Country	US
Kind code	B2
Filing date	Jan 28, 2015
Priority date	Jan 28, 2015
Publication date	Mar 14, 2017
Grant date	Mar 14, 2017

Abstract

In different embodiments of the present invention, systems, methods, and computer-readable storage media allow a user to analyze software application modules, during development of the software. The present invention may be used to analyze the software application modules, to identify vulnerabilities and to provide the user with actionable intelligence that may be used to improve the security of the software application modules. The actionable intelligence may include a list or groupings of the vulnerabilities ranked based on severability, type, and/or location.

First claim

What is claimed is:

1. A computer implemented method for analyzing a software application and for providing actionable intelligence on remediation efforts, including the steps of:
storing the software application on a memory device by a processor, the software application including a plurality of software application modules arranged in a predetermined flow structure, each software application module including predefined segments of code;
accessing each of the plurality of software application modules and identifying vulnerabilities within each predefined segments of code associated with the corresponding software application modules, using the processor programmed to operate as a vulnerability identification unit coupled to the memory device, and assigning a severity to each identified vulnerability;
analyzing, using the processor programmed to operate as a vulnerability correlation index generation unit coupled to the memory device and the vulnerability identification unit, the identified vulnerabilities and assigning a recommended vulnerability remediation effort to each identified vulnerability, establishing one or more groups of software application modules as a function of the assigned recommended vulnerability remediation efforts, and generating a vulnerability correlation index (VCI) value associated with each group of software application modules including comparing the predefined segments of code of each software application module included in a corresponding group;
selecting, using the processor programmed to operate as a code dependency index generation unit coupled to the memory device, the vulnerability identification unit, and the vulnerability correlation index unit, each group of software application modules having a predefined VCI value and analyzing each selected group of software application modules to identifying a code dependency index including a point within the predetermined flow structure common to each software application module within the same group of software application modules;
establishing, using the processor programmed to operate as a code vulnerability index generating unit coupled to the memory device, the vulnerability identification unit, the vulnerability correlation index generation unit, and the code dependency index generation unit, a code vulnerability index associated with each group of software application modules as a function of the vulnerabilities, the vulnerability correlation index and the code dependency index; and,
generating, using the processor programmed to operate as a prioritization list generation unit coupled to the memory device, the vulnerability identification unit, the vulnerability correlation index unit, and the code dependency index generation unit, a prioritized list of remediation efforts aimed at mitigating the identified vulnerabilities, the prioritized list of remediation efforts including the identified vulnerabilities and the severity assigned to each identified vulnerability, the vulnerability correlation index associated with each group of vulnerabilities, and the corresponding code dependency indexes and storing the prioritized list of remediation efforts within the memory device.

2. A method, as set forth in claim 1 , wherein the severity of each identified vulnerability is one of low, medium, and high.

3. A method, as set forth in claim 1 , wherein the groups of vulnerabilities are further established as a function of similar patterns in the software application modules, wherein the similar patterns may be one of an associated root cause and a remediation action.

4. A method, as set forth in claim 3 , wherein the memory device includes a historical database of known vulnerabilities and known associated remedial actions, wherein the recommended vulnerability remediation effort is assigned to each identified vulnerability as a function of the historical database of known vulnerabilities.

5. A method, as set forth in claim 4 , further including the step of comparing the software application modules associated with the vulnerabilities in each group of vulnerabilities, wherein the vulnerability correlation index is established as a function of the comparison between the software application modules associated with the vulnerabilities in each respective group of vulnerabilities.

6. A method, as set forth in claim 5 , wherein each group of software application modules is established from vulnerabilities having a common recommended vulnerability remediation effort is established if the associated vulnerability correlation index is above a predetermined threshold.

7. A method, as set forth in claim 1 , further including the step of identifying lines of code having the identified vulnerabilities, and storing the identified lines of code in the prioritized list of remediation efforts.

8. A system for analyzing a software application and for providing actionable intelligence on remediation efforts, comprising:
a memory device configured to store the software application, the software application including a plurality of software application modules arranged in a predetermined flow structure, each software application module including predefined segments of code; and
one or more processors coupled to the memory device, the one or more processors programmed to operate as:
a vulnerability identification unit coupled to the memory device and being configured to access each of the plurality of software application modules and identify vulnerabilities within each predefined segments of code associated with the corresponding software application modules and to assign a severity to each identified vulnerability;
a vulnerability correlation index generation unit coupled to the memory device and the vulnerability identification unit and being configured to analyze the identified vulnerabilities and to assign a recommended vulnerability remediation effort to each identified vulnerability, to establish one or more groups of software application modules as a function of the assigned recommended vulnerability remediation efforts, and to generate a vulnerability correlation index (VCI) value associated with each group of software application modules including comparing the predefined segments of code of each software application module included in a corresponding group;
a code dependency index generation unit coupled to the memory device, the vulnerability identification unit, and the vulnerability correlation index unit and being configured to select each group of software application modules having a predefined VCI value and analyze each selected group of software application modules to identify a code dependency index including a point within the predetermined flow structure common to each software application module within the same group of software application modules;
a code vulnerability index generating unit coupled to the memory device, the vulnerability identification unit, the vulnerability correlation index generation unit, and the code dependency index generation unit and being configured to establish a code vulnerability index associated with each group of software application modules as a function of the vulnerabilities, the vulnerability correlation index and the code dependency index; and,
a prioritization list generation unit coupled to the memory device, the vulnerability identification unit, the vulnerability correlation index unit, and the code dependency index generation unit, the prioritization list generation unit configured to generate a prioritized list of remediation efforts aimed at mitigating the identified vulnerabilities, the prioritized list of remediation efforts including the identified vulnerabilities and the severity assigned to each identified vulnerability, the vulnerability c

Assignees

• Wal Mart Stores Inc

Inventors

• Serrano Miguel Saiz
• Tsai Julie
• Manglani Kamal
• Walker Kevin D

Classifications

• G06F21/577 Primary

  Assessing vulnerabilities and evaluating computer system security · CPC title

• G06F9/44

  Arrangements for executing specific programs · CPC title

• G06F2221/033

  Test or assess software · CPC title