DMCA
A survey of static analysis methods for identifying security vulnerabilities in software systems (2007)
| Citations: | 12 - 0 self |
BibTeX
@MISC{Pistoia07asurvey,
author = {M. Pistoia and S. Chandra and S. J. Fink and E. Yahav},
title = {A survey of static analysis methods for identifying security vulnerabilities in software systems },
year = {2007}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
In this paper we survey static analysis methods for identifying security vulnerabilities in software systems. We cover three areas that have been associated with sources of security vulnerabilities: access-control, information-flow, and application-programming-interface conformance. Because access control mechanisms fall into two major categories, stack-based access control and role-based access control, we discuss static analysis techniques for these two areas of access control separately. Similarly, security violations pertaining to information flow consist of integrity violations and confidentiality violations, and consequently, our discussion of static analysis techniques for information-flow vulnerabilities includes these two topics. For each type of security vulnerability we present our findings in two parts: in the first part we describe recent research results, and in the second part we illustrate implementation techniques by describing selected static analysis algorithms.
Keyphrases
security vulnerability software system static analysis method access control static analysis technique second part first part static analysis algorithm information flow consist stack-based access control recent research result integrity violation survey static analysis method role-based access control information-flow vulnerability implementation technique security violation application-programming-interface conformance confidentiality violation major category
