Detecting Violations of Security Requirements for Vulnerability Discovery in Source Code

作者：Li Hongzhe; Oh Jaesang; Lee Heejo^*

来源：IEICE TRANSACTIONS ON INFORMATION AND SYSTEMS, 2016, E99D(9): 2385-2389.

DOI：10.1587/transinf.2016EDL8035

• software vulnerability
• security sinks
• security requirements

Finding software vulnerabilities in source code before the program gets deployed is crucial to ensure the software quality. Existing source code auditing tools for vulnerability detection generate too many false positives, and only limited types of vulnerability can be detected automatically. In this paper, we propose an extendable mechanism to reveal vulnerabilities in source code with low false positives by specifying security requirements and detecting requirement violations of the potential vulnerable sinks. The experimental results show that the proposed mechanism can detect vulnerabilities with zero false positives and indicate the extendability of the mechanism to cover more types of vulnerabilities.

• 出版日期2016-9