A Method for Software Vulnerability Detection Based on Improved Control Flow Graph

Citation metadata

Publisher: Springer
Document Type: Report
Length: 338 words

Document controls

Main content

Abstract :

Byline: Minmin Zhou (1), Jinfu Chen (1), Yisong Liu (1), Hilary Ackah-Arthur (1), Shujie Chen (1), Qingchen Zhang (1), Zhifeng Zeng (1) Keywords: software security; software vulnerability; improved control flow graph; vulnerability detection algorithm; TP 305 Abstract: With the rapid development of software technology, software vulnerability has become a major threat to computer security. The timely detection and repair of potential vulnerabilities in software, are of great significance in reducing system crashes and maintaining system security and integrity. This paper focuses on detecting three common types of vulnerabilities: Unused_ Variable, Use_of_Uninitialized_Variable, and Use_After_ Free. We propose a method for software vulnerability detection based on an improved control flow graph (ICFG) and several predicates of vulnerability properties for each type of vulnerability. We also define a set of grammar rules for analyzing and deriving the three mentioned types of vulnerabilities, and design three vulnerability detection algorithms to guide the process of vulnerability detection. In addition, we conduct cases studies of the three mentioned types of vulnerabilities with real vulnerability program segments from Common Weakness Enumeration (CWE). The results of the studies show that the proposed method can detect the vulnerability in the tested program segments. Finally, we conduct manual analysis and experiments on detecting the three types of vulnerability program segments (30 examples for each type) from CWE, to compare the vulnerability detection effectiveness of the proposed method with that of the existing detection tool CppCheck. The results show that the proposed method performs better. In summary, the method proposed in this paper has certain feasibility and effectiveness in detecting the three mentioned types of vulnerabilities, and it will also have guiding significance for the detection of other common vulnerabilities. Author Affiliation: (1) 0000 0001 0743 511X, grid.440785.a, School of Computer Science and Communication Engineering, Jiangsu University, Zhenjiang, Jiangsu, 212013, China Article History: Registration Date: 19/03/2019 Received Date: 01/07/2018 Online Date: 20/03/2019 Article note: Foundation item: Supported by the National Natural Science Foundation of China (61202110 and 61502205) and the Project of Jiangsu Provincial Six Talent Peaks ( XYDXXJS-016)

Source Citation

Source Citation   

Gale Document Number: GALE|A579551806