A parallel vulnerability detection framework via MPI

Gang Wang; Lei Wang

doi:10.1109/ICMSS.2011.5999219

A parallel vulnerability detection framework via MPI

Gang Wang^*
, Lei Wang

^*Corresponding author for this work

School of Computer Science and Engineering

Beihang University

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › peer-review

Abstract

Open source applications have flourished recent years. Meanwhile, security vulnerabilities in such applications have grown. Since manual code auditing is error-prone, time-consuming and costly, it is necessary to find automatic solutions. To address this problem we propose an approach that combines constraint-based analysis and model checking together. Model checking technology as a constraint solver can be employed to solve the constraint-based system. CodeAuditor, the prototype implementation of our methods, is targeted at detecting vulnerabilities in C source code. With this tool, 9 previously unknown vulnerabilities in two open source applications were discovered and the observed false positive rate was at around 29%.

Original language	English
Title of host publication	International Conference on Management and Service Science, MASS 2011
DOIs	https://doi.org/10.1109/ICMSS.2011.5999219
State	Published - 2011
Event	International Conference on Management and Service Science, MASS 2011 - Wuhan, China Duration: 12 Aug 2011 → 14 Aug 2011

Publication series

Name	International Conference on Management and Service Science, MASS 2011

Conference

Conference	International Conference on Management and Service Science, MASS 2011
Country/Territory	China
City	Wuhan
Period	12/08/11 → 14/08/11

Keywords

Code instrumentation
Constrain-based analysis
Model checking
Parallelism
Program vulnerability

Access to Document

10.1109/ICMSS.2011.5999219

Cite this

@inproceedings{fe25ba6d5e5e4f35951e4bd644352cd5,

title = "A parallel vulnerability detection framework via MPI",

abstract = "Open source applications have flourished recent years. Meanwhile, security vulnerabilities in such applications have grown. Since manual code auditing is error-prone, time-consuming and costly, it is necessary to find automatic solutions. To address this problem we propose an approach that combines constraint-based analysis and model checking together. Model checking technology as a constraint solver can be employed to solve the constraint-based system. CodeAuditor, the prototype implementation of our methods, is targeted at detecting vulnerabilities in C source code. With this tool, 9 previously unknown vulnerabilities in two open source applications were discovered and the observed false positive rate was at around 29\%.",

keywords = "Code instrumentation, Constrain-based analysis, Model checking, Parallelism, Program vulnerability",

author = "Gang Wang and Lei Wang",

year = "2011",

doi = "10.1109/ICMSS.2011.5999219",

language = "英语",

isbn = "9781424465811",

series = "International Conference on Management and Service Science, MASS 2011",

booktitle = "International Conference on Management and Service Science, MASS 2011",

note = "International Conference on Management and Service Science, MASS 2011 ; Conference date: 12-08-2011 Through 14-08-2011",

}

Wang, G & Wang, L 2011, A parallel vulnerability detection framework via MPI. in International Conference on Management and Service Science, MASS 2011., 5999219, International Conference on Management and Service Science, MASS 2011, International Conference on Management and Service Science, MASS 2011, Wuhan, China, 12/08/11. https://doi.org/10.1109/ICMSS.2011.5999219

TY - GEN

T1 - A parallel vulnerability detection framework via MPI

AU - Wang, Gang

AU - Wang, Lei

PY - 2011

Y1 - 2011

N2 - Open source applications have flourished recent years. Meanwhile, security vulnerabilities in such applications have grown. Since manual code auditing is error-prone, time-consuming and costly, it is necessary to find automatic solutions. To address this problem we propose an approach that combines constraint-based analysis and model checking together. Model checking technology as a constraint solver can be employed to solve the constraint-based system. CodeAuditor, the prototype implementation of our methods, is targeted at detecting vulnerabilities in C source code. With this tool, 9 previously unknown vulnerabilities in two open source applications were discovered and the observed false positive rate was at around 29%.

AB - Open source applications have flourished recent years. Meanwhile, security vulnerabilities in such applications have grown. Since manual code auditing is error-prone, time-consuming and costly, it is necessary to find automatic solutions. To address this problem we propose an approach that combines constraint-based analysis and model checking together. Model checking technology as a constraint solver can be employed to solve the constraint-based system. CodeAuditor, the prototype implementation of our methods, is targeted at detecting vulnerabilities in C source code. With this tool, 9 previously unknown vulnerabilities in two open source applications were discovered and the observed false positive rate was at around 29%.

KW - Code instrumentation

KW - Constrain-based analysis

KW - Model checking

KW - Parallelism

KW - Program vulnerability

UR - https://www.scopus.com/pages/publications/80052906271

U2 - 10.1109/ICMSS.2011.5999219

DO - 10.1109/ICMSS.2011.5999219

M3 - 会议稿件

AN - SCOPUS:80052906271

SN - 9781424465811

T3 - International Conference on Management and Service Science, MASS 2011

BT - International Conference on Management and Service Science, MASS 2011

T2 - International Conference on Management and Service Science, MASS 2011

Y2 - 12 August 2011 through 14 August 2011

ER -

A parallel vulnerability detection framework via MPI

Abstract

Publication series

Conference

Keywords

Access to Document

Other files and links

Fingerprint

Cite this