Abstract
Due to the lack of appropriate theory to accurately characterize vulnerabilities, the current static detection technologies have two key challenges, i.e., limited applicability, and the problem of state space explosion. In this paper, we put forward a static detection model based on the proposition function. Furthermore, a new program intermediate representation called Vulnerability Executable Path Set (VEPS) is proposed to optimize our model which compresses the program state space distinctly. In addition, in order to confirm the reliability of the static detection model, we conduct three terms of contrast experiments to estimate the results with the vulnerability disclosed by NIST. The results obtained from extensive experiments show that the proposed model effectively detects more Wireshark bugs than NIST, and reveals a higher detection efficiency than FindBugs.
Highlights
With the development of information technology, the number and scale of softwares are constantly expanding [1]
In order to avoid state space explosion in traditional static analysis, we propose program intermediate representation called Vulnerability Executable Path Set (VEPS) which compresses the program state space distinctly and achieves an optimized detection model
We carry out three terms of experiments, the results show that our model found more vulnerabilities in the typical open source Wireshark 1.2.0 than NIST announced
Summary
With the development of information technology, the number and scale of softwares are constantly expanding [1]. It has been demonstrated its efficacy by identifying 18 previously unknown vulnerabilities in the source code of the Linux kernel Dynamic detection technology, such as ‘‘fuzzers’’, can acquire specific operating information of the software. L. Han et al.: Optimized Static Propositional Function Model to Detect Software Vulnerability be identified by traditional functional testing methods [12]. In this paper, we propose a group-based static detection model for discriminating vulnerabilities, and use the defined proposition function to describe the attributes of software vulnerabilities. B. In order to avoid state space explosion in traditional static analysis, we propose program intermediate representation called Vulnerability Executable Path Set (VEPS) which compresses the program state space distinctly and achieves an optimized detection model.
Sign-in/Register to view highlights & summary Sign-in/Register to access full text options 
Free) 
Talk to us
Join us for a 30 min session where you can share your feedback and ask us any queries you have
Schedule a call
