.png){kind=icon}
返回
Detecting security vulnerabilities with vulnerability nets
.png){kind=icon}
PRE
AI
DOI：10.1016/j.jss.2023.111902.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Detecting security vulnerabilities is a crucial part in secure software development. Many static analysis tools have proved to be effective in finding vulnerabilities, but generally there are some complex and subtle vulnerabilities that can escape from detection. Manual audits are a complementary approach to using tools. Unfortunately, most manual analyses are tedious and error prone. To benefit from both the tools and manual audits, some approaches incorporate the auditor's expertise into a static analysis tool during vulnerability discovery. Following this strategy, this paper presents a representation of source code called a vulnerability net, which is a special Petri net that integrates with data dependence graphs and control flow graphs. The combined repre-sentation can facilitate the detection of taint-style vulnerabilities such as buffer overflows and injection vul-nerabilities. We test the proposed approach on Securibench Micro and demonstrate that it has the capability to identify a variety of vulnerabilities while keeping the rates of false negatives and positives low.
Keyword:
Vulnerability
Security
Static analysis
Manual audits
Petri nets
期刊
IF:
4.1
论文数:
5.5K
被引数:
8.4K
机构
引用论文
A series of non-quinoline cysLT1 receptor antagonists: Sar study on pyridyl analogs of singulair®
PREAI
分享收藏Late Bronze Age climate change and the destruction of the Mycenaean Palace of Nestor at Pylos青铜时代晚期的气候变化和皮洛斯内斯特迈锡尼宫的破坏.png)
PLOS ONE
OAAI
PLOS ONEIF0
OAAI分享收藏
查看更多内容