Effective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability Analysis
Talkat Global Security Vulnerability Summit @ Open Source Summit North America 2022 · on Friday, 2022-06-24· at 14:50· Brazos (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
An analysis method builds a sound, scalable call graph by abstractly interpreting dynamic types across application plus direct and indirect dependencies to mark which CVEs are actually reachable. Implementation in Mend shows about 70%+ vulnerabilities ineffective in Java projects and 63% ineffective in .NET, with measured accuracy around ~90% precision (recall drops when reflection is omitted). Scans finish quickly in practice — e.g. 27 seconds to scan 28k LOC — enabling prioritized remediation.
AI-written summary · about
chapters (10)
- 0:00Start
- 2:51What Is Vulnerability Effectiveness
- 4:11Ratio between Dependency and Proprietary Code
- 10:28Call Graph
- 10:49Call Graph to the Hello World Python Program
- 12:59Approximation Techniques for Building a Call Graph
- 20:50Name-Based Approaches
- 21:57Dynamic Method
- 26:32Interpreter Location
- 35:57Summary
related talks
30mTopics of Interest: Effective Usage Analysis: The Shortest Path Between a Developer ...
49mOpen-source vulnerability management? Use the source, Luke!
14mThe State of Open Source Vulnerabilities Management in 2019
22mWhen is a vulnerability not a vulnerability? Overcoming the...
45mEradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
27mFind and Track the hidden vulnerabilities inside your dependencies
05mWhy Can't Johnny Fix Vulnerabilities: A Usability Evaluation of Static Analysis Tools