.png){kind=icon}
Return
Detecting security vulnerabilities with vulnerability nets
.png){kind=icon}
PRE
AI
DOI：10.1016/j.jss.2023.111902.png)
.png){kind=icon}
Original request for help.png){kind=icon}
Share.png){kind=icon}
Save
Abstract
En 中文
Detecting security vulnerabilities is a crucial part in secure software development. Many static analysis tools have proved to be effective in finding vulnerabilities, but generally there are some complex and subtle vulnerabilities that can escape from detection. Manual audits are a complementary approach to using tools. Unfortunately, most manual analyses are tedious and error prone. To benefit from both the tools and manual audits, some approaches incorporate the auditor's expertise into a static analysis tool during vulnerability discovery. Following this strategy, this paper presents a representation of source code called a vulnerability net, which is a special Petri net that integrates with data dependence graphs and control flow graphs. The combined repre-sentation can facilitate the detection of taint-style vulnerabilities such as buffer overflows and injection vul-nerabilities. We test the proposed approach on Securibench Micro and demonstrate that it has the capability to identify a variety of vulnerabilities while keeping the rates of false negatives and positives low.
Keywords:
Vulnerability
Security
Static analysis
Manual audits
Petri nets
Journal
IF:
4.1
Papers:
5.5K
Citations:
8.4K
Organization
Cited Papers
ShareSaveShareSaveA series of non-quinoline cysLT1 receptor antagonists: Sar study on pyridyl analogs of singulair®
PREAI
ShareSaveLate Bronze Age climate change and the destruction of the Mycenaean Palace of Nestor at Pylos.png)
PLOS ONE
OAAI
PLOS ONEIF0
OAAIShareSave
ShareSave
View more