Automated Source Code Instrumentation for Verifying Potential Vulnerabilities - Inria - Institut national de recherche en sciences et technologies du numérique Accéder directement au contenu
Communication Dans Un Congrès Année : 2016

Automated Source Code Instrumentation for Verifying Potential Vulnerabilities

Hongzhe Li
  • Fonction : Auteur
  • PersonId : 989239
Jaesang Oh
  • Fonction : Auteur
  • PersonId : 989240
Hakjoo Oh
  • Fonction : Auteur
  • PersonId : 989241
Heejo Lee
  • Fonction : Auteur
  • PersonId : 989242

Résumé

With a rapid yearly growth rate, software vulnerabilities are making great threats to the system safety. In theory, detecting and removing vulnerabilities before the code gets ever deployed can greatly ensure the quality of software released. However, due to the enormous amount of code being developed as well as the lack of human resource and expertise, severe vulnerabilities still remain concealed or cannot be revealed effectively. Current source code auditing tools for vulnerability discovery either generate too many false positives or require overwhelming manual efforts to report actual software flaws. In this paper, we propose an automatic verification mechanism to discover and verify vulnerabilities by using program source instrumentation and concolic testing. In the beginning, we leverage CIL to statically analyze the source code including extracting the program CFG, locating the security sinks and backward tracing the sensitive variables. Subsequently, we perform automated program instrumentation to insert security probes ready for the vulnerability verification. Finally, the instrumented program source is passed to the concolic testing engine to verify and report the existence of an actual vulnerability. We demonstrate the efficacy and efficiency of our mechanism by implementing a prototype system and perform experiments with nearly 4000 test cases from Juliet Test Suite. The results show that our system can verify over 90 % of test cases and it reports buffer overflow flaws with P r e c i s i o n = 100 % (0 FP) and R e c a l l = 94.91 % . In order to prove the practicability of our system working in real world programs, we also apply our system on 2 popular Linux utilities, Bash and Cpio. As a result, our system finds and verifies vulnerabilities in a fully automatic way with no false positives.
Fichier principal
Vignette du fichier
421518_1_En_15_Chapter.pdf (4 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

hal-01369555 , version 1 (21-09-2016)

Licence

Paternité

Identifiants

Citer

Hongzhe Li, Jaesang Oh, Hakjoo Oh, Heejo Lee. Automated Source Code Instrumentation for Verifying Potential Vulnerabilities. 31st IFIP International Information Security and Privacy Conference (SEC), May 2016, Ghent, Belgium. pp.211-226, ⟨10.1007/978-3-319-33630-5_15⟩. ⟨hal-01369555⟩
86 Consultations
122 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More