面向源代码的软件漏洞静态检测综述

李珍; 邹德清; 王泽丽; 金海

doi:10.11959/j.issn.2096-109x.2019001

您当前的位置：

首页 >

文章列表页 >

面向源代码的软件漏洞静态检测综述

综述 | 更新时间：2024-06-03

- 面向源代码的软件漏洞静态检测综述
- Survey on static software vulnerability detection for source code
- 网络与信息安全学报 2019年5卷第1期页码：1-14
- 作者机构：
  
  1. 华中科技大学计算机科学与技术学院，湖北武汉 430074
  2. 华中科技大学服务计算技术与系统教育部重点实验室，湖北武汉 430074
  3. 华中科技大学集群与网格计算湖北省重点实验室，湖北武汉 430074
  4. 深圳华中科技大学研究院，广东深圳 518057
  5. 深圳华中科技大学研究院，广东深圳 518057
- 作者简介：
  
  [ "李珍（1981- ），女，河北保定人，华中科技大学博士生，主要研究方向为软件安全、漏洞检测。" ]
  [ "邹德清（1975- ），男，湖南湘潭人，华中科技大学教授、博士生导师，主要研究方向为云计算安全、网络攻防与漏洞检测、软件定义安全与主动防御、大数据安全与人工智能安全、容错计算。" ]
  [ "王泽丽（1995- ），女，湖北襄阳人，华中科技大学博士生，主要研究方向为区块链系统安全、智能合约安全。" ]
  [ "金海（1966- ），男，上海人，华中科技大学教授、博士生导师，主要研究方向为计算机系统结构、虚拟化技术、集群计算、网格计算、并行与分布式计算、对等计算、普适计算、语义网、存储与安全。" ]
- 基金信息：
  
  国家重点研发计划项目;The National Key Research ＆ Development (R＆D) Plan of China(2017YFB0802205);国家自然科学基金资助项目;The National Natural Science Foundation of China(61672249);深圳市基础研究（学科布局）基金资助项目;The Shenzhen Fundamental Research Program(JCYJ20170413114215614)
- DOI：10.11959/j.issn.2096-109x.2019001
  中图分类号： TP393
- 网络首发：2019-02，
  
  纸质出版：2019-02-15
- 稿件说明：
移动端阅览
李珍, 邹德清, 王泽丽, 等. 面向源代码的软件漏洞静态检测综述[J]. 网络与信息安全学报, 2019,5(1):1-14.

Zhen LI, Deqing ZOU, Zeli WANG, et al. Survey on static software vulnerability detection for source code[J]. Chinese Journal of Network and Information Security, 2019, 5(1): 1-14.
李珍, 邹德清, 王泽丽, 等. 面向源代码的软件漏洞静态检测综述[J]. 网络与信息安全学报, 2019,5(1):1-14. DOI： 10.11959/j.issn.2096-109x.2019001.

Zhen LI, Deqing ZOU, Zeli WANG, et al. Survey on static software vulnerability detection for source code[J]. Chinese Journal of Network and Information Security, 2019, 5(1): 1-14. DOI： 10.11959/j.issn.2096-109x.2019001.

摘要

软件静态漏洞检测依据分析对象主要分为二进制漏洞检测和源代码漏洞检测。由于源代码含有更为丰富的语义信息而备受代码审查人员的青睐。针对现有的源代码漏洞检测研究工作，从基于代码相似性的漏洞检测、基于符号执行的漏洞检测、基于规则的漏洞检测以及基于机器学习的漏洞检测4个方面进行了总结，并以基于源代码相似性的漏洞检测系统和面向源代码的软件漏洞智能检测系统两个具体方案为例详细介绍了漏洞检测过程。

Abstract

Static software vulnerability detection is mainly divided into two types according to different analysis objects:vulnerability detection for binary code and vulnerability detection for source code.Because the source codecontains more semantic information

it is more favored by code auditors.The existing vulnerability detection research works for source code are summarized from four aspects:code similarity-based vulnerability detection

symbolic execution-based vulnerability detection

rule-based vulnerability detection

and machine learning-based vulnerability detection.The vulnerability detection system based on source code similarity and the intelligent software vulnerability detection system for source code are taken as two examples to introduce the process of vulnerability detection in detail.

关键词

Keywords

references

CHOWDHURY I , ZULKERNINE M . Using complexity,coupling,and cohesion metrics as early indicators of vulnerabilities [J ] . Journal of Systems Architecture , 2011 , 57 ( 13 ): 244 - 313 .

NEUHAUS S , ZIMMERMANN T , HOLLER C , et al . Predictingvulnerable software components [C ] // The 14th ACM Conference on Computer and Communications Security (CCS) . 2007 : 529 - 540 .

JANG J , AGRAWAL A , BRUMLEY D . ReDeBug:finding unpatched code clones in entire OS distributions [C ] // 2012 IEEE Symposium on Security and Privacy (S＆P) . 2012 : 48 - 62 .

LI H , KWON H , KWON J , et al . A scalable approach for vulnerability discovery based on security patches [C ] // International Conference on Applications and Techniques in Information Security (ATIC) . 2014 : 109 - 122 .

SCANDARIATO R , WALDEN J , HOVSEPYAN A , et al . Predicting vulnerable software components via text mining [J ] . IEEE Transactions on Software Engineering , 2014 , 40 ( 10 ): 993 - 1006 .

YAMAGUCHI F , LINDNER F , RIECK K . Vulnerability extrapolation:Assisted discovery of vulnerabilities using machine learning [C ] // The 5th USENIX Workshop on Offensive Technologies (WOOT) . 2011 : 118 - 127 .

LI Z , LU S , MYAGMAR S , et al . CP-Miner:finding copy-paste and related bugs in large-scale software code [J ] . IEEE Transactions on Software Engineering , 2006 , 32 ( 3 ): 176 - 192 .

YAMAGUCHI F , LOTTMANN M , AND RIECK K . Generalized vulnerability extrapolation using abstract syntax trees [C ] // The 28th Annual Computer Security Applications Conference (ACSAC) . 2012 : 359 - 368 .

PHAM N H , NGUYEN T T , NGUYEN H A , et al . Detection of recurring software vulnerabilities [C ] // The IEEE/ACM International Conference on Automated Software Engineering,Montpellier,France . 2010 : 447 - 456 .

YAMAGUCHI F , GOLDE N , ARP D , et al . Modeling and discovering vulnerabilities with code property graphs [C ] // The IEEE Symposium on Security and Privacy (S＆P) . 2014 : 590 - 604 .

LI J , ERNST M D . CBCD:cloned buggy code detector [C ] // The 34th International Conference on Software Engineering (ICSE) . 2012 : 310 - 320 .

KOMONDOOR R , HORWITZ S . Using slicing to identify duplication in source code [C ] // The International Static Analysis Symposium . 2001 : 40 - 56 .

李赞 , 边攀 , 石文昌 , 等 . 一种利用补丁的未知漏洞发现方法 [J ] . 软件学报 , 2018 , 29 ( 5 ): 1199 - 1212 .

LI Z , BIAN P , SHI W C , et al . Approach of leveraging patches to discover unknown vulnerabilities [J ] . Journal of Software , 2018 , 29 ( 5 ): 1199 - 1212 .

KOSCHKE R , FALKE R , FRENZEL P . Clone detection using abstract syntax suffix trees [C ] // The 13th Working Conference on Reverse Engineering (WCRE) . 2006 : 253 - 262 .

RATTAN D , BHATIA R , SINGH M . Software clone detection:a systematic review [J ] . Information and Software Technology , 2013 , 55 ( 7 ): 1165 - 1199 .

LIANG H , WANG L , WU D , et al . MLSA:a static bugs analysis toolbased on LLVM IR [C ] // The 17th IEEE/ACIS International Conference on Software Engineering,Artificial Intelligence,Networking and Parallel/Distributed Computing (SNPD) . 2016 : 407 - 412 .

CASSEZ F , SLOANE A M , ROBERTS M , et al . Skink:static analysis of programs in LLVM intermediate representation (competition contribution) [C ] // The 23rd International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS) . 2017 : 380 - 384 .

THOME J , SHAR L K , BIANCULLI D , et al . Search-driven string constraint solving for vulnerability detection [C ] // The 39th International Conference on Software Engineering (ICSE) . 2017 : 198 - 208 .

沈维军 , 汤恩义 , 陈振宇 , 等 . 数值稳定性相关漏洞隐患的自动化检测方法 [J ] . 软件学报 , 2018 , 29 ( 5 ): 1230 - 1243 .

SHEN W J , TANG E Y , CHEN Z Y , et al . Method for automated detection of suspicious vulnerability related to numerical stability [J ] . Journal of Software , 2018 , 29 ( 5 ): 1230 - 1243 .

王雅文 , 姚欣洪 , 宫云战 , 等 . 一种基于代码静态分析的缓冲区溢出检测算法 [J ] . 计算机研究与发展 , 2012 , 49 ( 4 ): 839 - 845 .

WANG Y W , YAO X H , GONG Y Z , et al . A method of buffer overflow detection based on static code analysis [J ] . Journal of Computer Research and Development , 2012 , 49 ( 4 ): 839 - 845 .

王蕾 , 李丰 , 李炼 , 等 . 污点分析技术的原理和实践应用 [J ] . 软件学报 , 2017 , 28 ( 4 ): 860 - 882 .

WANG L , LI F , LI L , et al . Principle and practice of taint analysis [J ] . Journal of Software , 2017 , 28 ( 4 ): 860 - 882 .

RAHMA M , QUSAY H M . Evaluation of static analysis tools for finding vulnerabilities in Java and C/C++ source code [J ] .CoRR abs/1805.09040,2018. CoRR abs/1805.09040 , 2018 .

HOSSAIN S , MOHAMMAD Z . Mitigating program security vulnerabilities:approaches and challenges [J ] . ACM Computer Survey , 2012 , 44 ( 3 ): 1 - 46 .

VIEGA J , BLOCH J T , KOHNO Y , et al . ITS4:a static vulnerability scanner for C and C++ code [C ] // The 16th Annual Computer Security Applications Conference,New Orleans,Louisiana . 2000 : 257 - 267 .

ANIQUA Z B , TAMARA D . IDE plugins for detecting input-validation vulnerabilitie [C ] // IEEE Symposium on Security and Privacy Workshops . 2017 : 143 - 146 .

JAMES W , MAUREEN D . SAVI:static-analysis vulnerability indicator [J ] . IEEE Security ＆ Privacy , 2012 , 10 ( 3 ): 32 - 39 .

BILL B , . How to find and fix software vulnerabilities with Coverity static analysis [C ] // IEEE Cybersecurity Development (SecDev) . 2016 :153.

YAMAGUCHI F . Pattern-based vulnerability discovery [D ] . Dissertation:University of Gottingen , 2015 .

YAMAGUCHI F , WRESSNEGGER C , GASCON H . et al . Chucky:exposing missing checks in source code for vulnerability discovery [C ] // The 2013 ACM SIGSAC Conference on Computer and Communications Security . 2013 : 499 - 510 .

YAMAGUCHI F , MAIER A , GASCON H . et al . Automatic inference of search patterns for taint-style vulnerabilities [C ] // The 2015 IEEE Symposium on Security and Privacy (S＆P) . 2015 : 797 - 812 .

SHANKAR U , TALWAR K , FOSTER J S , et al . Detecting format string vulnerabilities with type qualifiers [C ] // The 10th USENIX Security Symposium . 2001 : 201 - 220 .

BACKES M , KOPF B , RYBALCHENKO A . Automatic discovery and quantification of information leaks [C ] // The 30th IEEE Symposium on Security and Privacy (S＆P) . 2009 : 141 - 153 .

GRIECO G , GRINBLAT G L , UZAL L , et al . Toward large-scale vulnerability discovery using machine learning [C ] // The 6th ACM Conference on Data and Application Security and Privacy . 2009 : 85 - 96 .

NEUHAUS S , ZIMMERMANN T , HOLLER C , et al . Predicting vulnerable software components [C ] // The 14th ACM Conference on Computer and Communications Security (CCS) . 2007 : 529 - 540 .

SHIN Y , MENEELY A , WILLIAMS L , et al . Evaluating complexity,code churn,and developer activity metrics as indicators of software vulnerabilities [J ] . IEEE Transactions on Software Engineering , 2011 , 37 ( 6 ): 772 - 787 .

MOSHTARI S , SAMI A . Evaluating and comparing complexity,coupling and a new proposed set of coupling metrics in cross-project vulnerability prediction [C ] // The 31st Annual ACM Symposium on Applied Computing . 2016 : 1415 - 1421 .

SCANDARIATO R , WALDEN J , HOVSEPYAN A , et al . Predicting vulnerable software components via text mining [J ] . IEEE Transactions on Software Engineering , 2014 , 401 ( 10 ): 993 - 1006 .

LIN G , ZHANG J , LUO W , et al . POSTER:vulnerability discovery with function representation learning from unlabeled projects [C ] // The 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS) . 2017 : 2539 - 2541 .

XU X , LIU C , FENG Q , et al . Neural network-based graph embedding for cross-platform binary code similarity detection [C ] // The 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS) . 2017 : 363 - 376 .

RAJPAL M , BLUM W , SINGH R . Not all bytes are equal:neural byte sieve for fuzzing [J ] . CoRR,vol.abs/1711.04596 , 2017 .

RUSSELl R L , KIM L Y , HAMILTON L H , et al . Automated vulnerability detection in source code using deep representation learning [J ] . CoRR,vol.abs/1807.04320 , 2018 .

HARER J A , KIM L Y , RUSSELL R L , et al . Automated software vulnerability detection with machine learning [J ] . CoRR,vol.abs/1803.04497 , 2018 .

YANG X , LO D , XIA X , et al . Deep learning for just-in-time defect prediction [C ] // The 2015 IEEE International Conference on Software Quality,Reliability and Security (QRS) . 2015 : 17 - 26 .

WANG S , LIU T , TAN L . Automatically learning semantic features for defect prediction [C ] // The 38th International Conference on Software Engineering (ICSE) . 2016 : 297 - 308 .

PHAN A V , NGUYEN M L , BUI L T . Convolutional neural networks over control flow graphs for software defect prediction [C ] // 29th IEEE International Conference on Tools with Artificial Intelligence (ICTAI) . 2017 : 45 - 52 .

LI J , HE P , ZHU J.et al . Software defect prediction via convolutional neural network [C ] // The 2017 IEEE International Conference on Software Quality,Reliability and Security (QRS) . 2017 : 318 - 328 .

DAM H K , PHAM T , NG S W , et al . A deep tree-based model for software defect prediction [J ] . CoRR abs/1802.00921 , 2018 .

HUO X , LI M , ZHOU Z H . Learning unified features from natural and programming languages for locating buggy source code [C ] // The 25th International Joint Conference on Artificial Intelligence (IJCAI) . 2016 : 1606 - 1612 .

XIAO Y , KEUNG J , MI Q , et al . Bug localization with semantic and structural features using convolutional neural network and cascade forest [C ] // The 22nd International Conference on Evaluation and Assessment in Software Engineering (EASE) . 2018 : 101 - 111 .

DU M , LI F , ZHENG G , et al . DeepLog:anomaly detection and diagnosis from system logs through deep learning [C ] // The 2017 ACM SIGSAC Conference on Computer and Communications Security (CCS) . 2017 : 1285 - 1298 .

WHITE M , VENDOME C , LINARES-VÁSQUEZ M , et al . Toward deep learning software repositories [C ] // The 2015 IEEE/ACM 12th Working Conference on Mining Software Repositories (MSR) . 2015 : 334 - 345 .

WHITE M , TUFANO M , VENDOME C , et al . Deep learning code fragments for code clone detection [C ] // The 31st IEEE/ACM International Conference on Automated Software Engineering (ASE) . 2016 : 87 - 98 .

GU X , ZHANG H , ZHANG D , et al . Deep API learning [C ] // The 24th ACM SIGSOFT International Symposium on Foundations of Software Engineering (FSE) . 2016 : 631 - 642 .

SHIN E C R , SONG D , MOAZZEZI R . Recognizing functions in binaries with neural networks [C ] // The 24th USENIX Security Symposium . 2015 : 611 - 626 .

SAXE J , BERLIN K . eXpose:a character-level convolutional neural network with embeddings for detecting malicious URLs,file paths and registry keys [J ] . CoRR,vol.abs/1702.08568 , 2017 .

RAHUL G , SOHAM P , ADITYA K , et al . DeepFix:fixing common C language errors by deep learning [C ] // The 31st AAAI Conference on Artificial Intelligence (AAAI) . 2017 : 1345 - 1351 .

GUO J , CHENG J H , HUANG J C . Semantically enhanced software traceability using deep learning techniques [C ] // The 39th IEEE/ACM International Conference on Software Engineering (ICSE) . 2017 : 3 - 14 .

ALON U , ZILBERSTEIN U , LEVY O , et al . A general path-based representation for predicting program properties [C ] // The 39th ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) . 2018 : 404 - 419 .

ALSULAMI B , DAUBER E , RICHARD E . Source code authorship attribution using long short-term memory based networks [C ] // The 22nd European Symposium on Research in Computer Security (ESORICS) . 2017 : 65 - 82 .

LI Z , ZOU D Q , XU S H , et al . VulPecker:an automated vulnerability detection system based on code similarity analysis [C ] // The 32nd Annual Computer Security Applications Conference (ACSAC) . 2016 : 201 - 213 .

FALLERI J R , MORANDAT F , BLANC X , et al . Fine-grained and accurate source code differencing [C ] // The 29th ACM/IEEE International Conference on Automated Software Engineering (ASE) . 2014 : 313 - 324 .

LI Z , ZOU D Q , XU S H , et al . VulDeePecker:a deep learning-based system for vulnerability detection [C ] // The 25th Annual Network and Distributed System Security Symposium (NDSS) . 2018 .

浏览量

6439

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于双路特征提取和自适应融合的钓鱼网站检测

DNS异常检测：大规模实验分析

基于代码相似性的软件漏洞检测研究进展

FL-IoV：基于联邦学习的综合车联网入侵检测方法

基于分层结构的多任务对抗样本归因方法