Exploring context-sensitive data flow analysis for early vulnerability detection

doi:10.1016/j.jss.2015.12.021

Exploring context-sensitive data flow analysis for early vulnerability detection

2016-03-01

21

PRE

AI

L

L.E. Bittencout Sampaio *

A

Alessandro Garcia

DOI：10.1016/j.jss.2015.12.021

原文链接

原文求助

摘要

En 中文

Secure programming is the practice of writing programs that are resistant to attacks by malicious people or programs. Programmers of secure software have to be continuously aware of security vulnerabilities when writing their program statements. In order to improve programmers' awareness, static analysis techniques have been devised to find vulnerabilities in the source code. However, most of these techniques are built to encourage vulnerability detection a posteriori, only when developers have already fully produced (and compiled) one or more modules of a program. Therefore, this approach, also known as late detection, does not support secure programming but rather encourages posterior security analysis. The lateness of vulnerability detection is also influenced by the high rate of false positives yielded by pattern matching, the underlying mechanism used by existing static analysis techniques. The goal of this paper is twofold. First, we propose to perform continuous detection of security vulnerabilities while the developer is editing each program statement, also known as early detection. Early detection can leverage his knowledge on the context of the code being created, contrary to late detection when developers struggle to recall and fix the intricacies of the vulnerable code they produced from hours to weeks ago. Second, we explore context-sensitive data flow analysis (DFA) for improving vulnerability detection and mitigate the limitations of pattern matching. DFA might be suitable for finding if an object has a vulnerable path. To this end, we have implemented a proof-of-concept Eclipse plugin for continuous DFA-based detection of vulnerabilities in Java programs. We also performed two empirical studies based on several industry-strength systems to evaluate if the code security can be improved through DFA and early vulnerability detection. Our studies confirmed that: (i) the use of context-sensitive DFA significantly reduces the rate of false positives when compared to existing techniques, without being detrimental to the detector performance, and (ii) early detection improves the awareness among developers and encourages programmers to fix security vulnerabilities promptly. (C) 2015 Elsevier Inc. All rights reserved.

Keyword:

Early detection

Data flow analysis

Secure programming

Exploring context-sensitive data flow analysis for early vulnerability detection

摘要

AI总结

期刊

机构

引用论文