Integrated security workbench
Inventors
Mishra, Prateek • Wright, Jonathan S. • Faria, Peter • Pereira, Carl C. • Atkins, Kenneth D. • Bhargava, Gaurav • Iype, Seena A.
Assignees
Interested in licensing this patent?
MTEC can help explore whether this patent might be available for licensing for your application.
Publication Number
US-12423440-B2
Publication Date
2025-09-23
Expiration Date
Abstract
The present disclosure relates generally to a security workbench and, more particularly, to a system, method and computer program product which integrates different scanner types into a single, integrated security tool. The method, for example, includes: integrating, by a computer system, a plurality of scanner types into a single tool; and displaying, by the computer system, an output of any of the plurality of scanner types run on software code in a standardized format in a graphical user interface of the tool.
Core Innovation
The invention provides an integrated security workbench that receives a request to detect security vulnerabilities in one or more sections of software code, where the software code corresponds to a plurality of development branches. One or more processors select one or more scanner tools configured to analyze respective sections of the software code, with selection based on an identifier of the one or more sections and a scanner type of the one or more scanner tools. For each section, the system identifies a corresponding development branch from the plurality of development branches and prepares scan execution for the selected tools.
The workbench executes each selected scanner tool via a containerized executable environment on a corresponding section of the software code to generate scanner output in an unstructured format. The system converts the scanner output in the unstructured format into a standardized format using a data model by extracting values from the scanner output and mapping the values to fields defined in the data model. This standardized conversion supports a unified vulnerability view across multiple scanner types and multiple development branches.
The system causes a display of the scanner output in the standardized format via a graphical user interface. The display includes security vulnerabilities detected in the one or more sections by each selected scanner tool and further includes a vulnerability summary comprising security vulnerabilities detected in each development branch.
Claims Coverage
The document includes three independent claims covering a system, a method, and one or more non-transitory computer-readable storage media. Across the independent claims, five inventive features are described.
Branch-based security vulnerability detection across sections
Receiving a request to detect security vulnerabilities in one or more sections of software code, wherein the software code corresponds to a plurality of development branches; selecting a corresponding development branch for each section.
Scanner-tool selection based on section identifier and scanner type
Selecting one or more scanner tools configured to analyze respective sections of the software code, the selection based on an identifier of the one or more sections and a scanner type of the one or more scanner tools.
Containerized execution of scanner tools
Executing, via a containerized executable environment, each selected scanner tool on a corresponding section of the software code to generate scanner output in an unstructured format.
Data-model conversion into standardized format
Converting, using a data model, the scanner output in the unstructured format into a standardized format by extracting values from the scanner output and mapping the values to fields defined in the data model.
GUI display with standardized vulnerabilities and per-branch summary
Causing a display of the scanner output in the standardized format via a graphical user interface, comprising the security vulnerabilities detected by each selected scanner tool and a vulnerability summary comprising the security vulnerabilities detected in each development branch.
The independent claims consistently cover branch-based vulnerability detection, scanner-tool selection by section identifier and scanner type, containerized execution, standardized conversion via a data model, and graphical display with a vulnerability summary by development branch.
Stated Advantages
Uniform security posture review across teams and products.
Reduced maintenance/infrastructure and processing overhead.
Enforcement of consistent enterprise compliance.
Normalized, standardized vulnerability outputs for multiple scanner types.
Supports mapping/scoring/remediation attributes including severity, remediation guidance, false positives, and acceptable risk.
Provides repository/product/team linkage via metadata for vulnerability association.
Enables packaging/scanner plug-in integration for CI/CD pipelines using Docker images.
Supports GUI drill-down, including hyperlinks to code locations and severity-based filtering.
Automates issue tracking via JIRA ticket creation and status updates.
Provides dashboards/charts for scan activity and vulnerability progress over time.
Documented Applications
Run security scans on code across products, development branches, and repositories using layered integration of multiple scanner types, and present normalized vulnerability results in a GUI with per-branch summaries.
Integrate the scanner workflow as a packaging/scanner plug-in for CI/CD pipelines using Docker images.
Use GUI functionality to view product/repository/security summaries, filter vulnerabilities by severity, drill down to code locations with hyperlinks, and manage notes/reopen actions.
Create and update JIRA tickets for detected vulnerabilities, and track vulnerability status over time.
Use dashboards/charts to view scan activity and vulnerability progress over time.
Interested in licensing this patent?