MOPS: an Infrastructure for Examining Security Properties of Software

DMCA

MOPS: an Infrastructure for Examining Security Properties of Software (2002)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by Hao Chen , David Wagner

Venue:	In Proceedings of the 9th ACM Conference on Computer and Communications Security
Citations:	233 - 8 self

BibTeX

@INPROCEEDINGS{Chen02mops:an,
    author = {Hao Chen and David Wagner},
    title = {MOPS: an Infrastructure for Examining Security Properties of Software},
    booktitle = {In Proceedings of the 9th ACM Conference on Computer and Communications Security},
    year = {2002},
    pages = {235--244},
    publisher = {ACM Press}
}

OpenURL

Abstract

We describe a formal approach for finding bugs in security-relevant software and verifying their absence. The idea is as follows: we identify rules of safe programming practice, encode them as safety properties, and verify whether these properties are obeyed. Because manual verification is too expensive, we have built a program analysis tool to automate this process. Our program analysis models the program to be verified as a pushdown automaton, represents the security property as a finite state automaton, and uses model checking techniques to identify whether any state violating the desired security goal is reachable in the program. The major advantages of this approach are that it is sound in verifying the absence of certain classes of vulnerabilities, that it is fully interprocedural, and that it is efficient and scalable. Experience suggests that this approach will be useful in finding a wide range of security vulnerabilities in large programs efficiently.

Keyphrases

examining security property program analysis tool safety property finite state automaton security vulnerability large program major advantage desired security goal formal approach program analysis model wide range manual verification safe programming practice certain class pushdown automaton security-relevant software security property

DMCA