Efficient Static Vulnerability Analysis for JavaScript with Multiversion Dependency Graphs
summary
Introduces Multiversion Dependency Graphs as a single, versioned object graph that records property updates and data-flow order, implemented in Graph.js and evaluated against ODGen on Vulcan/SAbench. Claims: 82% recall vs ODGen’s ~50%, finds 49 previously unreported vulnerabilities (3 CVEs), finishes analysis on 37% more packages and builds graphs with 14% of the nodes and 42% of the edges. Uses Neo4j/Cypher for compact, simpler queries and formalized construction.
AI-written summary · about
chapters (9)
- 0:00Node.js and vulnerability challenges
- 2:27Static analysis with code property graphs
- 5:01Limitations of ODgen and MDG
- 7:53Building multiversion dependency graphs
- 9:19GraphJS scanner implementation
- 10:23Evaluation methodology and datasets
- 11:48Performance versus ODgen
- 12:53Conclusion and vulnerabilities
- 13:35Q&A
related talks
31mTransforming Vulnerability Management with Advanced Dependency Knowledge Graphs
39mUsing GraphDB Technology to Resolve Transitive Vulnerabilities at Scale
38mEffective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability Analysis
18mDecisions, Open Source, Graph Theory, and Static Analysis
40mTransitive Vulnerabilities Exploit In Real-life
40mDependency Management: The Cause of—and Solution to—All Supply...
39mTrials and Tribulations of Updating Dependencies for Vulnerability...
27mFind and Track the hidden vulnerabilities inside your dependencies