The VXDF Engine: A Multi-Stage Architecture for Evidence-Based Security

// Core BaseFact interface
interface BaseFact {
  id: string;                    // Unique identifier
  type: FactType;               // VULNERABILITY | ENDPOINT | PACKAGE | CONFIG
  location: SourceLocation;     // File path, line numbers
  provenance: ProvenanceInfo;   // Source tool, version, timestamp
  confidence: number;           // Initial confidence [0.0, 1.0]
  metadata: Record<string, any>; // Tool-specific data
}

// Example: SQL Injection from Semgrep SARIF
const vulnFact: VulnerabilityFact = {
  id: "vuln_001",
  type: "VULNERABILITY",
  location: {
    filePath: "src/models/user.py",
    startLine: 45,
    endLine: 47,
    codeSnippet: "cursor.execute(f\"SELECT * FROM users WHERE id = {user_id}\")"
  },
  provenance: {
    tool: "semgrep",
    version: "1.45.0",
    ruleId: "python.lang.security.audit.sqli.python-sqli",
    timestamp: "2024-01-15T10:30:00Z"
  },
  confidence: 0.8,
  vulnerabilityData: {
    cweId: "CWE-89",
    severity: "HIGH",
    category: "SQL_INJECTION",
    sinkFunction: "cursor.execute",
    taintedParameter: "user_id"
  }
};

// Heuristic correlation example
function correlateByProximity(facts: BaseFact[]): CorrelationEdge[] {
  const edges: CorrelationEdge[] = [];
  
  for (const vulnFact of facts.filter(f => f.type === 'VULNERABILITY')) {
    for (const endpointFact of facts.filter(f => f.type === 'ENDPOINT')) {
      const pathSimilarity = calculatePathSimilarity(
        vulnFact.location.filePath,
        endpointFact.location.filePath
      );
      
      if (pathSimilarity > 0.7) { // Same directory or similar naming
        edges.push({
          source: endpointFact.id,
          target: vulnFact.id,
          relationship: 'heuristic_proximity',
          confidence: 0.2 + (pathSimilarity * 0.2),
          evidence: { pathSimilarity, heuristic: 'file_proximity' }
        });
      }
    }
  }
  
  return edges;
}

// Import graph traversal for Python/JavaScript
class ImportGraphAnalyzer {
  buildImportGraph(codebase: string): ImportGraph {
    // Parse import statements across the codebase
    // Build directed graph of module dependencies
  }
  
  findImportPath(sourceFile: string, targetFile: string): ImportPath | null {
    // BFS/DFS to find if sourceFile can reach targetFile
    // Return path: [file1 -> file2 -> ... -> targetFile]
  }
  
  correlateViaImports(endpointFact: EndpointFact, vulnFact: VulnerabilityFact): CorrelationEdge | null {
    const importPath = this.findImportPath(
      endpointFact.location.filePath,
      vulnFact.location.filePath
    );
    
    if (importPath) {
      return {
        source: endpointFact.id,
        target: vulnFact.id,
        relationship: 'has_import_path_to',
        confidence: 0.6,
        evidence: { 
          importPath: importPath.pathSteps,
          transitiveDepth: importPath.length 
        }
      };
    }
    
    return null;
  }
}

// Dynamic Semgrep rule generation for taint analysis
class TaintAnalysisOrchestrator {
  async validateDataFlow(sourceNode: EndpointFact, sinkNode: VulnerabilityFact): Promise<TaintResult> {
    // Generate custom Semgrep rule for this specific source-sink pair
    const customRule = this.generateTaintRule(sourceNode, sinkNode);
    
    // Execute Semgrep with the generated rule
    const semgrepResult = await this.executeSemgrep(customRule);
    
    if (semgrepResult.findings.length > 0) {
      return {
        hasDataFlow: true,
        confidence: 0.9,
        staticTrace: semgrepResult.findings[0].dataFlowTrace,
        evidence: {
          semgrepRule: customRule,
          traceSteps: semgrepResult.findings[0].dataFlowTrace
        }
      };
    }
    
    return { hasDataFlow: false, confidence: 0.0 };
  }
  
  private generateTaintRule(endpoint: EndpointFact, vuln: VulnerabilityFact): SemgrepRule {
    return {
      id: `custom-taint-${endpoint.id}-to-${vuln.id}`,
      pattern: `
        rules:
          - id: custom-data-flow-check
            mode: taint
            pattern-sources:
              - patterns:
                - pattern: ${endpoint.parameterPattern}  # e.g., request.args.get("user_id")
            pattern-sinks:  
              - patterns:
                - pattern: ${vuln.sinkPattern}          # e.g., cursor.execute(...)
            message: "Data flows from endpoint parameter to vulnerable sink"
      `
    };
  }
}