DMCA
Generalized vulnerability extrapolation using abstract syntax trees (2012)
| Venue: | In Annual Computer Security Applications Conference (ACSAC |
| Citations: | 9 - 4 self |
BibTeX
@INPROCEEDINGS{Yamaguchi12generalizedvulnerability,
author = {Fabian Yamaguchi and Markus Lottmann and Konrad Rieck},
title = {Generalized vulnerability extrapolation using abstract syntax trees},
booktitle = {In Annual Computer Security Applications Conference (ACSAC},
year = {2012},
pages = {359--368}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
The discovery of vulnerabilities in source code is a key for securing computer systems. While specific types of security flaws can be identified automatically, in the general case the process of finding vulnerabilities cannot be automated and vulnerabilities are mainly discovered by manual analysis. In this paper, we propose a method for assisting a security an-alyst during auditing of source code. Our method proceeds by extracting abstract syntax trees from the code and de-termining structural patterns in these trees, such that each function in the code can be described as a mixture of these patterns. This representation enables us to decompose a known vulnerability and extrapolate it to a code base, such that functions potentially suffering from the same flaw can be suggested to the analyst. We evaluate our method on the source code of four popular open-source projects: LibTIFF, FFmpeg, Pidgin and Asterisk. For three of these projects, we are able to identify zero-day vulnerabilities by inspecting only a small fraction of the code bases. 1.
Keyphrases
abstract syntax tree source code vulnerability extrapolation code base zero-day vulnerability method proceeds known vulnerability de-termining structural pattern manual analysis security an-alyst small fraction general case computer system popular open-source project security flaw specific type
