Compare Complexity Metrics with Known Vulnerable Code to Identify Additional Vulnerable Code
Use McCabe IQ to compare code metrics and graphs to identify whether modules exist that are similar to code containing security vulnerabilities.
An organization or project may be aware of a set of modules that have been found to have security vulnerabilities, which might have been identified:
- in their own organization's projects, or
- from such code known to the industry (some available from McCabe).
We recommend using McCabe IQ's comparison feature (from Battlemap GUI or command line) to compare those modules of known vulnerability with all code in your projects, to identify similar modules (in terms of graphs, metrics, call names, etc.) that may contain those same vulnerabilities. Thus, you can unravel exploitable code by comparable algorithmic patterns, signatures, and derivations using widely adopted industry source code metrics.
Such similar modules might have been duplicated/cloned or plagiarized, and have the same security flaw as the known code; or they may have been copied/pasted then modified slightly to contain a security flaw when the original code had not. The security analyst should analyze that list of modules found to be similar, to determine whether they have similar or additional security problems relative to those with the known vulnerabilities.
- To schedule a live demonstration or to speak with us about your software security requirements, Contact Us Here.