Detecting Security Vulnerabilities with Vulnerability Nets

Abstract

Detecting code vulnerabilities is a crucial part in secure software development. Many static analysis tools have been proven useful in finding vulnerabilities, but generally there are some complex and subtle vulnerabilities that can escape detection. Manual audits are a complementary approach to using tools. Unfortunately, most manual analyses are tedious and error prone. To benefit from both the tools and manual audits, some work incorporates the auditor's expertise into a static analysis tool during vulnerability discovery. Following this strategy, this paper presents vulnerability nets, which are a special Petri net that integrates with data dependence graphs and control flow graphs. Specifically, the proposed approach is intended for detecting taint-style vulnerabilities such as buffer overflows and injection vulnerabilities. In this paper, the construction and use of vulnerability nets are discussed in detail. Furthermore, we show the feasibility by presenting a case study in analyzing an example adapted from a real-world case.