Toward Automated Security Risk Detection in Large Software Using Call Graph Analysis

2025-10-30

AI Summary

Manual threat modeling for large-scale software systems is labor-intensive, error-prone, and difficult to scale. To address this, this paper proposes a semi-automated threat modeling framework based on call-graph clustering. The method constructs a fine-grained call graph and integrates density-based clustering (DBSCAN) with community detection algorithms, augmented by interpretable code-level metrics—such as code density—to automatically identify high-risk modules and potential security weaknesses. Its key innovation lies in synergistically combining program structure analysis with graph clustering techniques for precise threat region localization, thereby significantly enhancing the systematicity, scalability, and reproducibility of threat modeling in cloud-native environments. Empirical evaluation on the Splunk Forwarder Operator demonstrates that the approach accurately pinpoints security vulnerabilities arising from high-density coupling. Overall, it establishes a novel, efficient, and structured risk assessment paradigm for large-scale software systems.

Technology Category

• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Machine Learning: Clustering
• Planning, Routing, and Scheduling: Model-Based Reasoning

Application Category

• Security and Privacy: Large-scale security measurements
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs

Abstract

Threat modeling plays a critical role in the identification and mitigation of security risks; however, manual approaches are often labor intensive and prone to error. This paper investigates the automation of software threat modeling through the clustering of call graphs using density-based and community detection algorithms, followed by an analysis of the threats associated with the identified clusters. The proposed method was evaluated through a case study of the Splunk Forwarder Operator (SFO), wherein selected clustering metrics were applied to the software's call graph to assess pertinent code-density security weaknesses. The results demonstrate the viability of the approach and underscore its potential to facilitate systematic threat assessment. This work contributes to the advancement of scalable, semi-automated threat modeling frameworks tailored for modern cloud-native environments.

Problem

• Automating security risk detection in large software
• Using call graph clustering for threat modeling
• Addressing manual labor intensity and error proneness

Innovation

• Automates threat modeling using call graph clustering
• Applies density-based and community detection algorithms
• Evaluates security risks through cluster analysis metrics