Survey on static software vulnerability detection for source code

Zhen LI; Deqing ZOU; Zeli WANG; Hai JIN

doi:10.11959/j.issn.2096-109x.2019001

您当前的位置：

首页 >

文章列表页 >

Survey on static software vulnerability detection for source code

Comprehensive Review | 更新时间：2024-06-03

- Survey on static software vulnerability detection for source code
- Chinese Journal of Network and Information Security Vol. 5, Issue 1, Pages: 1-14(2019)
- 作者机构：
  
  1. 华中科技大学计算机科学与技术学院，湖北武汉 430074
  2. 华中科技大学服务计算技术与系统教育部重点实验室，湖北武汉 430074
  3. 华中科技大学集群与网格计算湖北省重点实验室，湖北武汉 430074
  4. 深圳华中科技大学研究院，广东深圳 518057
  5. 深圳华中科技大学研究院，广东深圳 518057
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2019001
  CLC： TP393
- Online First：2019-02，
  
  Published：15 February 2019
- 稿件说明：
移动端阅览
Zhen LI, Deqing ZOU, Zeli WANG, et al. Survey on static software vulnerability detection for source code[J]. Chinese Journal of Network and Information Security, 2019, 5(1): 1-14.
DOI：

Zhen LI, Deqing ZOU, Zeli WANG, et al. Survey on static software vulnerability detection for source code[J]. Chinese Journal of Network and Information Security, 2019, 5(1): 1-14. DOI： 10.11959/j.issn.2096-109x.2019001.

摘要

软件静态漏洞检测依据分析对象主要分为二进制漏洞检测和源代码漏洞检测。由于源代码含有更为丰富的语义信息而备受代码审查人员的青睐。针对现有的源代码漏洞检测研究工作，从基于代码相似性的漏洞检测、基于符号执行的漏洞检测、基于规则的漏洞检测以及基于机器学习的漏洞检测4个方面进行了总结，并以基于源代码相似性的漏洞检测系统和面向源代码的软件漏洞智能检测系统两个具体方案为例详细介绍了漏洞检测过程。

Abstract

Static software vulnerability detection is mainly divided into two types according to different analysis objects:vulnerability detection for binary code and vulnerability detection for source code.Because the source codecontains more semantic information

it is more favored by code auditors.The existing vulnerability detection research works for source code are summarized from four aspects:code similarity-based vulnerability detection

symbolic execution-based vulnerability detection

rule-based vulnerability detection

and machine learning-based vulnerability detection.The vulnerability detection system based on source code similarity and the intelligent software vulnerability detection system for source code are taken as two examples to introduce the process of vulnerability detection in detail.

关键词

Keywords

references

CHOWDHURY I , ZULKERNINE M . Using complexity,coupling,and cohesion metrics as early indicators of vulnerabilities [J ] . Journal of Systems Architecture , 2011 , 57 ( 13 ): 244 - 313 .

NEUHAUS S , ZIMMERMANN T , HOLLER C , et al . Predictingvulnerable software components [C ] // The 14th ACM Conference on Computer and Communications Security (CCS) . 2007 : 529 - 540 .

JANG J , AGRAWAL A , BRUMLEY D . ReDeBug:finding unpatched code clones in entire OS distributions [C ] // 2012 IEEE Symposium on Security and Privacy (S＆P) . 2012 : 48 - 62 .

LI H , KWON H , KWON J , et al . A scalable approach for vulnerability discovery based on security patches [C ] // International Conference on Applications and Techniques in Information Security (ATIC) . 2014 : 109 - 122 .

SCANDARIATO R , WALDEN J , HOVSEPYAN A , et al . Predicting vulnerable software components via text mining [J ] . IEEE Transactions on Software Engineering , 2014 , 40 ( 10 ): 993 - 1006 .

YAMAGUCHI F , LINDNER F , RIECK K . Vulnerability extrapolation:Assisted discovery of vulnerabilities using machine learning [C ] // The 5th USENIX Workshop on Offensive Technologies (WOOT) . 2011 : 118 - 127 .

LI Z , LU S , MYAGMAR S , et al . CP-Miner:finding copy-paste and related bugs in large-scale software code [J ] . IEEE Transactions on Software Engineering , 2006 , 32 ( 3 ): 176 - 192 .

YAMAGUCHI F , LOTTMANN M , AND RIECK K . Generalized vulnerability extrapolation using abstract syntax trees [C ] // The 28th Annual Computer Security Applications Conference (ACSAC) . 2012 : 359 - 368 .

PHAM N H , NGUYEN T T , NGUYEN H A , et al . Detection of recurring software vulnerabilities [C ] // The IEEE/ACM International Conference on Automated Software Engineering,Montpellier,France . 2010 : 447 - 456 .

YAMAGUCHI F , GOLDE N , ARP D , et al . Modeling and discovering vulnerabilities with code property graphs [C ] // The IEEE Symposium on Security and Privacy (S＆P) . 2014 : 590 - 604 .

LI J , ERNST M D . CBCD:cloned buggy code detector [C ] // The 34th International Conference on Software Engineering (ICSE) . 2012 : 310 - 320 .

KOMONDOOR R , HORWITZ S . Using slicing to identify duplication in source code [C ] // The International Static Analysis Symposium . 2001 : 40 - 56 .

李赞 , 边攀 , 石文昌 , 等 . 一种利用补丁的未知漏洞发现方法 [J ] . 软件学报 , 2018 , 29 ( 5 ): 1199 - 1212 .

LI Z , BIAN P , SHI W C , et al . Approach of leveraging patches to discover unknown vulnerabilities [J ] . Journal of Software , 2018 , 29 ( 5 ): 1199 - 1212 .

KOSCHKE R , FALKE R , FRENZEL P . Clone detection using abstract syntax suffix trees [C ] // The 13th Working Conference on Reverse Engineering (WCRE) . 2006 : 253 - 262 .

RATTAN D , BHATIA R , SINGH M . Software clone detection:a systematic review [J ] . Information and Software Technology , 2013 , 55 ( 7 ): 1165 - 1199 .

LIANG H , WANG L , WU D , et al . MLSA:a static bugs analysis toolbased on LLVM IR [C ] // The 17th IEEE/ACIS International Conference on Software Engineering,Artificial Intelligence,Networking and Parallel/Distributed Computing (SNPD) . 2016 : 407 - 412 .

CASSEZ F , SLOANE A M , ROBERTS M , et al . Skink:static analysis of programs in LLVM intermediate representation (competition contribution) [C ] // The 23rd International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS) . 2017 : 380 - 384 .

THOME J , SHAR L K , BIANCULLI D , et al . Search-driven string constraint solving for vulnerability detection [C ] // The 39th International Conference on Software Engineering (ICSE) . 2017 : 198 - 208 .

沈维军 , 汤恩义 , 陈振宇 , 等 . 数值稳定性相关漏洞隐患的自动化检测方法 [J ] . 软件学报 , 2018 , 29 ( 5 ): 1230 - 1243 .

SHEN W J , TANG E Y , CHEN Z Y , et al . Method for automated detection of suspicious vulnerability related to numerical stability [J ] . Journal of Software , 2018 , 29 ( 5 ): 1230 - 1243 .

王雅文 , 姚欣洪 , 宫云战 , 等 . 一种基于代码静态分析的缓冲区溢出检测算法 [J ] . 计算机研究与发展 , 2012 , 49 ( 4 ): 839 - 845 .

WANG Y W , YAO X H , GONG Y Z , et al . A method of buffer overflow detection based on static code analysis [J ] . Journal of Computer Research and Development , 2012 , 49 ( 4 ): 839 - 845 .

王蕾 , 李丰 , 李炼 , 等 . 污点分析技术的原理和实践应用 [J ] . 软件学报 , 2017 , 28 ( 4 ): 860 - 882 .

WANG L , LI F , LI L , et al . Principle and practice of taint analysis [J ] . Journal of Software , 2017 , 28 ( 4 ): 860 - 882 .

RAHMA M , QUSAY H M . Evaluation of static analysis tools for finding vulnerabilities in Java and C/C++ source code [J ] .CoRR abs/1805.09040,2018. CoRR abs/1805.09040 , 2018 .

HOSSAIN S , MOHAMMAD Z . Mitigating program security vulnerabilities:approaches and challenges [J ] . ACM Computer Survey , 2012 , 44 ( 3 ): 1 - 46 .

VIEGA J , BLOCH J T , KOHNO Y , et al . ITS4:a static vulnerability scanner for C and C++ code [C ] // The 16th Annual Computer Security Applications Conference,New Orleans,Louisiana . 2000 : 257 - 267 .

ANIQUA Z B , TAMARA D . IDE plugins for detecting input-validation vulnerabilitie [C ] // IEEE Symposium on Security and Privacy Workshops . 2017 : 143 - 146 .

JAMES W , MAUREEN D . SAVI:static-analysis vulnerability indicator [J ] . IEEE Security ＆ Privacy , 2012 , 10 ( 3 ): 32 - 39 .

BILL B , . How to find and fix software vulnerabilities with Coverity static analysis [C ] // IEEE Cybersecurity Development (SecDev) . 2016 :153.

YAMAGUCHI F . Pattern-based vulnerability discovery [D ] . Dissertation:University of Gottingen , 2015 .

YAMAGUCHI F , WRESSNEGGER C , GASCON H . et al . Chucky:exposing missing checks in source code for vulnerability discovery [C ] // The 2013 ACM SIGSAC Conference on Computer and Communications Security . 2013 : 499 - 510 .

YAMAGUCHI F , MAIER A , GASCON H . et al . Automatic inference of search patterns for taint-style vulnerabilities [C ] // The 2015 IEEE Symposium on Security and Privacy (S＆P) . 2015 : 797 - 812 .

SHANKAR U , TALWAR K , FOSTER J S , et al . Detecting format string vulnerabilities with type qualifiers [C ] // The 10th USENIX Security Symposium . 2001 : 201 - 220 .

BACKES M , KOPF B , RYBALCHENKO A . Automatic discovery and quantification of information leaks [C ] // The 30th IEEE Symposium on Security and Privacy (S＆P) . 2009 : 141 - 153 .

GRIECO G , GRINBLAT G L , UZAL L , et al . Toward large-scale vulnerability discovery using machine learning [C ] // The 6th ACM Conference on Data and Application Security and Privacy . 2009 : 85 - 96 .

NEUHAUS S , ZIMMERMANN T , HOLLER C , et al . Predicting vulnerable software components [C ] // The 14th ACM Conference on Computer and Communications Security (CCS) . 2007 : 529 - 540 .

SHIN Y , MENEELY A , WILLIAMS L , et al . Evaluating complexity,code churn,and developer activity metrics as indicators of software vulnerabilities [J ] . IEEE Transactions on Software Engineering , 2011 , 37 ( 6 ): 772 - 787 .

MOSHTARI S , SAMI A . Evaluating and comparing complexity,coupling and a new proposed set of coupling metrics in cross-project vulnerability prediction [C ] // The 31st Annual ACM Symposium on Applied Computing . 2016 : 1415 - 1421 .

SCANDARIATO R , WALDEN J , HOVSEPYAN A , et al . Predicting vulnerable software components via text mining [J ] . IEEE Transactions on Software Engineering , 2014 , 401 ( 10 ): 993 - 1006 .

LIN G , ZHANG J , LUO W , et al . POSTER:vulnerability discovery with function representation learning from unlabeled projects [C ] // The 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS) . 2017 : 2539 - 2541 .

XU X , LIU C , FENG Q , et al . Neural network-based graph embedding for cross-platform binary code similarity detection [C ] // The 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS) . 2017 : 363 - 376 .

RAJPAL M , BLUM W , SINGH R . Not all bytes are equal:neural byte sieve for fuzzing [J ] . CoRR,vol.abs/1711.04596 , 2017 .

RUSSELl R L , KIM L Y , HAMILTON L H , et al . Automated vulnerability detection in source code using deep representation learning [J ] . CoRR,vol.abs/1807.04320 , 2018 .

HARER J A , KIM L Y , RUSSELL R L , et al . Automated software vulnerability detection with machine learning [J ] . CoRR,vol.abs/1803.04497 , 2018 .

YANG X , LO D , XIA X , et al . Deep learning for just-in-time defect prediction [C ] // The 2015 IEEE International Conference on Software Quality,Reliability and Security (QRS) . 2015 : 17 - 26 .

WANG S , LIU T , TAN L . Automatically learning semantic features for defect prediction [C ] // The 38th International Conference on Software Engineering (ICSE) . 2016 : 297 - 308 .

PHAN A V , NGUYEN M L , BUI L T . Convolutional neural networks over control flow graphs for software defect prediction [C ] // 29th IEEE International Conference on Tools with Artificial Intelligence (ICTAI) . 2017 : 45 - 52 .

LI J , HE P , ZHU J.et al . Software defect prediction via convolutional neural network [C ] // The 2017 IEEE International Conference on Software Quality,Reliability and Security (QRS) . 2017 : 318 - 328 .

DAM H K , PHAM T , NG S W , et al . A deep tree-based model for software defect prediction [J ] . CoRR abs/1802.00921 , 2018 .

HUO X , LI M , ZHOU Z H . Learning unified features from natural and programming languages for locating buggy source code [C ] // The 25th International Joint Conference on Artificial Intelligence (IJCAI) . 2016 : 1606 - 1612 .

XIAO Y , KEUNG J , MI Q , et al . Bug localization with semantic and structural features using convolutional neural network and cascade forest [C ] // The 22nd International Conference on Evaluation and Assessment in Software Engineering (EASE) . 2018 : 101 - 111 .

DU M , LI F , ZHENG G , et al . DeepLog:anomaly detection and diagnosis from system logs through deep learning [C ] // The 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS) . 2017 : 1285 - 1298 .

WHITE M , VENDOME C , LINARES-VÁSQUEZ M , et al . Toward deep learning software repositories [C ] // The 2015 IEEE/ACM 12th Working Conference on Mining Software Repositories (MSR) . 2015 : 334 - 345 .

WHITE M , TUFANO M , VENDOME C , et al . Deep learning code fragments for code clone detection [C ] // The 31st IEEE/ACM International Conference on Automated Software Engineering (ASE) . 2016 : 87 - 98 .

GU X , ZHANG H , ZHANG D , et al . Deep API learning [C ] // The 24th ACM SIGSOFT International Symposium on Foundations of Software Engineering (FSE) . 2016 : 631 - 642 .

SHIN E C R , SONG D , MOAZZEZI R . Recognizing functions in binaries with neural networks [C ] // The 24th USENIX Security Symposium . 2015 : 611 - 626 .

SAXE J , BERLIN K . eXpose:a character-level convolutional neural network with embeddings for detecting malicious URLs,file paths and registry keys [J ] . CoRR,vol.abs/1702.08568 , 2017 .

RAHUL G , SOHAM P , ADITYA K , et al . DeepFix:fixing common C language errors by deep learning [C ] // The 31st AAAI Conference on Artificial Intelligence (AAAI) . 2017 : 1345 - 1351 .

GUO J , CHENG J H , HUANG J C . Semantically enhanced software traceability using deep learning techniques [C ] // The 39th IEEE/ACM International Conference on Software Engineering (ICSE) . 2017 : 3 - 14 .

ALON U , ZILBERSTEIN U , LEVY O , et al . A general path-based representation for predicting program properties [C ] // The 39th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) . 2018 : 404 - 419 .

ALSULAMI B , DAUBER E , RICHARD E . Source code authorship attribution using long short-term memory based networks [C ] // The 22nd European Symposium on Research in Computer Security (ESORICS) . 2017 : 65 - 82 .

LI Z , ZOU D Q , XU S H , et al . VulPecker:an automated vulnerability detection system based on code similarity analysis [C ] // The 32nd Annual Computer Security Applications Conference (ACSAC) . 2016 : 201 - 213 .

FALLERI J R , MORANDAT F , BLANC X , et al . Fine-grained and accurate source code differencing [C ] // The 29th ACM/IEEE International Conference on Automated Software Engineering (ASE) . 2014 : 313 - 324 .

LI Z , ZOU D Q , XU S H , et al . VulDeePecker:a deep learning-based system for vulnerability detection [C ] // The 25th Annual Network and Distributed System Security Symposium (NDSS) . 2018 .

Views

6439

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Phishing website detection based on two-way feature extraction and adaptive fusion

Anomaly detection in DNS: an empirical study

Research progress on detection of software vulnerabilities based on code similarity

FL-IoV: comprehensive intrusion detection method for internet of vehicles based on federated learning

Multi-task adversarial attribution method based on hierarchical structure

Related Author

Guo Kai

Wang Heng

Ma Ziqiang

HOU Ronghao

HE Ming

KONG Kaichuan

CHEN Yong

ZUO Peng

Related Institution

School of Information Engineering, Ningxia University

China Internet Network Information Center

School of Cyber Science and Engineering, Jinan University

Information Engineering University

Beijing Unionpay Card Technology Co., Ltd., Shenzhen Branch

⁰