Abstract:Missing a security operation such as a bound check has been a major cause of security-critical bugs. Automatically checking whether the code misses a security operation in large programs is challenging since it has to understand whether the security operation is indeed necessary in the context. Recent methods typically employ cross-checking to identify deviations as security bugs, which collects functionally similar program slices and infers missed security operations through majority-voting. An inherent limitation of such approaches is that they heavily rely on a substantial number of similar code pieces to enable cross-checking. In practice, many code pieces are unique, and thus we may be unable to find adequate similar code snippets to utilize cross-checking. In this paper, we present IPPO (Inconsistent Path Pairs as a bug Oracle), a static analysis framework for detecting security bugs based on differential checking. IPPO defines several novel rules to identify code paths that share similar semantics with respect to an object, and collects them as similar-path pairs. It then investigates the path pairs for identifying inconsistent security operations with respect to the object. If one path in a path pair enforces a security operation while the other does not, IPPO reports it as a potential security bug. By utilizing on object-based path-similarity analysis, IPPO achieves a higher precision, compared to conventional code-similarity analysis methods. Through differential checking of a similar-path pair, IPPO eliminates the requirement of constructing a large number of similar code pieces, addressing the limitation of traditional cross-checking approaches. We implemented IPPO and extensively evaluated it on four widely used open-source programs: Linux kernel, OpenSSL library, FreeBSD kernel, and PHP. IPPO found 154, 5, 1, and 1 new security bugs in the above systems, respectively. We have submitted patches for all these bugs, and 136 of them have been accepted by corresponding maintainers. The results confirm the effectiveness and usefulness of IPPO in practice.

OOPN-SRAM: A Novel Method for Software Risk Assessment

ROPNN: Detection of ROP Payloads Using Deep Neural Networks

Vulnerability Analysis of Clock Synchronization Protocol Using Stochastic Petri Net

Risk Assessment in Power System Based on Parallel Computation

Research on modeling method of power system network security risk assessment based on object-oriented Bayesian network

Application of Petri Net with Objects in Safety System Process Modeling

An Object-Oriented Method for Information System Security Evaluation

An OVAL-based Active Vulnerability Assessment System for Enterprise Computer Networks.

CARATS: A Computer-Aided Reliability Assessment Tool for Software Based on Object-Oriented Design

A Risk Assessment Method of New-type Power System Based on TabRAM

Object-Oriented Software Reliability Assessment Tool: CARATS

Detecting Missed Security Operations Through Differential Checking of Object-based Similar Paths.

Pfair scheduling of fixed and migrating periodic tasks on multiple resources

An Effective Software Risk Prediction Management Analysis of Data Using Machine Learning and Data Mining Method

Security Enhancement for RRAM Computing System through Obfuscating Crossbar Row Connections

Quantitative Analysis of Value-Based Software Processes Using Decision-Based Stochastic Object Petri-Nets

Risk Based Testing of Open Source Software (OSS)

Design, Implementation, and Automation of a Risk Management Approach for Man-at-the-End Software Protection

A markov game theory-based risk assessment model for network information system

Study on information system risk assessment method

A synergy-effect-incorporated fuzzy Petri net modeling paradigm with application in risk assessment