Automated Source Code Instrumentation for Verifying Potential Vulnerabilities - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2016

Automated Source Code Instrumentation for Verifying Potential Vulnerabilities

Hongzhe Li
  • Function : Author
  • PersonId : 989239
Jaesang Oh
  • Function : Author
  • PersonId : 989240
Hakjoo Oh
  • Function : Author
  • PersonId : 989241
Heejo Lee
  • Function : Author
  • PersonId : 989242

Abstract

With a rapid yearly growth rate, software vulnerabilities are making great threats to the system safety. In theory, detecting and removing vulnerabilities before the code gets ever deployed can greatly ensure the quality of software released. However, due to the enormous amount of code being developed as well as the lack of human resource and expertise, severe vulnerabilities still remain concealed or cannot be revealed effectively. Current source code auditing tools for vulnerability discovery either generate too many false positives or require overwhelming manual efforts to report actual software flaws. In this paper, we propose an automatic verification mechanism to discover and verify vulnerabilities by using program source instrumentation and concolic testing. In the beginning, we leverage CIL to statically analyze the source code including extracting the program CFG, locating the security sinks and backward tracing the sensitive variables. Subsequently, we perform automated program instrumentation to insert security probes ready for the vulnerability verification. Finally, the instrumented program source is passed to the concolic testing engine to verify and report the existence of an actual vulnerability. We demonstrate the efficacy and efficiency of our mechanism by implementing a prototype system and perform experiments with nearly 4000 test cases from Juliet Test Suite. The results show that our system can verify over 90 % of test cases and it reports buffer overflow flaws with P r e c i s i o n = 100 % (0 FP) and R e c a l l = 94.91 % . In order to prove the practicability of our system working in real world programs, we also apply our system on 2 popular Linux utilities, Bash and Cpio. As a result, our system finds and verifies vulnerabilities in a fully automatic way with no false positives.
Fichier principal
Vignette du fichier
421518_1_En_15_Chapter.pdf (4 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-01369555 , version 1 (21-09-2016)

Licence

Attribution

Identifiers

Cite

Hongzhe Li, Jaesang Oh, Hakjoo Oh, Heejo Lee. Automated Source Code Instrumentation for Verifying Potential Vulnerabilities. 31st IFIP International Information Security and Privacy Conference (SEC), May 2016, Ghent, Belgium. pp.211-226, ⟨10.1007/978-3-319-33630-5_15⟩. ⟨hal-01369555⟩
79 View
106 Download

Altmetric

Share

Gmail Facebook Twitter LinkedIn More