Control Flow Graph Construction Research Articles

A Static Detection Method for SQL Injection Vulnerability Based on Program Transformation

Static analysis is popular for detecting SQL injection vulnerabilities. However, due to the lack of accurate modeling of object-oriented database extensions, current methods fail to accurately detect SQL injection vulnerabilities in applications that use object-oriented database extensions. We propose a program transformation-based SQL injection vulnerability detection method to address this issue. This method consists of two stages: program transformation and vulnerability detection. In the first stage, object-oriented database extensions are automatically transformed into semantically equivalent procedural database extensions through the identification of key statements, call relation verification, and program transformation. In the second stage, application programs are automatically scanned using a combination of control flow graph construction and taint analysis techniques to detect SQL injection vulnerabilities. Based on the proposed method, we have implemented the OODBE-SCAN prototype system and performed experimental analysis on eight modern PHP applications. We compare OODBE-SCAN with two related static analysis tools, RIPS and Seay. The results show that OODBE-SCAN can detect more real-world vulnerabilities and has higher accuracy than existing methods.

Static vulnerability mining of IoT devices based on control flow graph construction and graph embedding network

Automatic static vulnerability analysis for IoT devices is always an important and challenging research problem. Traditional vulnerability finding methods are primarily based on manually built structures, which have limitations in accuracy and lack consideration of environmental information. In this paper, we propose a new approach that generates an ACFG (attributed control flow graph) that combines ambient information with binary code information, which aims to discover vulnerabilities from binaries deeply and accurately. The graph is then transformed by a graph-embedding algorithm and analyzed by a deep neural network. This approach has scalability on IoT devices when cross-architecture and cross-system binaries are considered. Ambient information makes this model able to detect environment-aware vulnerabilities. Experiment shows that this method has outperformed the state-of-the-art methods in terms of accuracy, efficiency, and scalability, with an average accuracy of over 80% on real-world vulnerability datasets.

Real-Time Modulation of Physical Training Intensity Based on Wavelet Recursive Fuzzy Neural Networks.

In this study, a wavelet recurrent fuzzy neural network is used to conduct in-depth research and analysis on the real-time regulation of physical training intensity. Firstly, an inter-process control technique is proposed to solve the problem of incomplete control flow graph construction caused by the inability to effectively collect all program control flow information in the process of static analysis, in preparation for the research of fuzzy testing technique. Next, a wavelet recursive fuzzy neural network-guided fuzzy testing technique is proposed to solve the problem of fuzzy tests falling into invalid variation due to the lack of directionality in the fuzzy testing process. Each neuron in the feedforward network is divided into different groups according to the order of receiving information. Each group can be regarded as a neural layer. The neurons in each layer receive the output of the neurons in the previous layer and output to the neurons in the next layer. The empirical data show that injury-preventive fitness training can effectively improve all physical qualities in the first phase of preparation and can effectively maintain the physical state and effectively contribute to their abilities during the competition period, and its injury-preventive fitness training interventions were verified by statistical analysis to have a dangerous main effect on their pre and post-test performance. Therefore, it is still not possible to determine its correlation with the coordination and improvement of the athletes' physical fitness, and the integration of the basic physical training and rehabilitation physical training systems, making this theory a new special training theory.

BBB-CFI

Code-reuse attack is a concrete threat to computing systems because it can evade conventional security defenses. Control flow integrity (CFI) is proposed to repel this threat. However, former implementations of CFI suffer from two major drawbacks: complex offline processing on programs and high overheads at runtime. Therefore, it is impractical for performance-constrained devices to adopt the technology, leaving them vulnerable to exploitation. In this article, we develop a cross-layer approach named basic-block-boundary-based control flow integrity (BBB-CFI) to minimize the overheads of both offline analysis and runtime checking. Our approach employs basic block information inside the binary code and read-only data to enforce CFI. We identify a key binary-level property called basic block boundary , and based on it we propose the code-inspired method where short code sequences can endorse a control flow transition. Our solution enables quick application launching because it does not require control flow graph construction at the offline stage. We only demand a lightweight analysis on read-only data and a small amount of code of the application. According to the experiments, our approach incurs a negligible 0.11% runtime performance overhead with a minor processor extension, whereas it achieves an order of magnitude speedup in pre-preprocessing compared to a baseline approach. Without control flow analysis or recompilation, BBB-CFI still effectively reduces 90% of the attack surface in terms of gadget numbers. Besides this, we show that the Turing-completeness in the libc is unsustainable. Our approach also demonstrates high applicability to many programs, and it is capable of protecting striped binaries.

SharpChecker: Static analysis tool for C# programs

This paper considers various aspects of static analysis of C# programs in order to detect the maximum number of software bugs in an acceptable time. A complete cycle of software static analysis is described with the main focus being placed on the specifics of the C# language. Some methods are discussed that take into account popular features of C# at all levels of analysis: call graph and control flow graph construction, dataflow analysis, as well as context- and path-sensitive interprocedural analysis. A symbolic execution method is proposed, which is based on the works devoted to the Bounded Model Checking (BMC) and the Saturn Software Analysis Project. A memory model is described that enables an accurate intraprocedural analysis and allows one to create compact representations of error conditions associated with functions, which are essential for interprocedural analysis. A special attention is paid to the optimizations that occur during path-sensitive analysis of error conditions. The conditions need to be optimized in terms of size, because path-sensitive interprocedural analysis requires saving a large number of conditions for each analyzed function. The conditions are resolved using advanced SMT solvers (such as the Microsoft Z3 Prover). This paper also considers various approaches to modeling the behavior of library functions: based on a summary containing a set of properties required for analysis, or based on simplified implementations in C#. All the discussed solutions are implemented in the SharpChecker static analysis tool and are tested on a number of open-source projects from 1.5 thousand to 1.35 million lines of code.

Инфраструктура статического анализа программ на языке C#

The paper describes static analysis techniques that are used for defect detection in C# programs. The goal of proposed analysis approaches is to catch more defects within an acceptable amount of time. Although the paper contains a description of full analysis cycle, it mainly focuses on special aspects that distinguish C# analysis approaches from well-known Java and C++ techniques. The paper illustrates methods that allow taking into account C# specialties of all analysis stages: call graph and control flow graph construction, data flow analysis, context- and path-sensitive interprocedural analysis. We propose an adaptation of symbolic execution methods inspired by Bounded Model Checking and Saturn Software Analysis Project. The paper also explains the organization of memory model, which is suitable for both a precise intraprocedural analysis and a creation of compact function-bound conditions used for interprocedural analysis. Special attention is paid to optimization of condition size and simplicity during a path sensitive-analysis. The conditions produced by a path-sensitive analysis are supposed to be solved by modern SMT solvers like Microsoft Z3 Prover. Different approaches to external functions modeling are covered. All proposed approaches are implemented in the SharpChecker static analysis tool and, as evaluated on several open source C# projects of varying size (1K - 1.35M lines of code), display good results and scalability.

PaddyFrog: systematically detecting confused deputy vulnerability in Android applications

An enormous number of applications have been developed for Android in recent years, making it one of the most popular mobile operating systems. However, it is obvious that more vulnerabilities would appear along with the booming amounts of applications. Poorly designed applications may contain security vulnerabilities that can dramatically undermine users' security and privacy. In this paper, we studied a kind of recently reported application vulnerability named confused deputy - a specific type of privilege escalation vulnerability, which can result in unauthorized operations, and so on. We proposed a novel system with code-level static analysis to analyze the applications and automatically detect possible confused deputy vulnerabilities. To tackle analysis challenges imposed by Android's component-based programming paradigm, we employed special control flow graph construction techniques to build call relations among components and function call graph within components. We developed a prototype of this system named PaddyFrog and evaluated with 7190 real world Android applications from two of the most popular markets in China. We found 1240 applications with confused deputy vulnerability and proved to be exploitable. The median execution time of this system on an application is 14.4s, which is fast enough to be used in volumes of applications testing scenarios. Copyright © 2015 John Wiley & Sons, Ltd.

Over-Approximated Control Flow Graph Construction on Pure Esterel

Esterel is an imperative synchronous language for control-dominant reactive systems. Regardless of imperative features of Esterel, combination of parallel execution and preemption makes it difficult to build control flow graphs (CFGs) of Esterel programs. Simple and convenient CFGs can help to analyze Esterel programs. However, previous researches are not suitable for flow analyses of imperative languages. In this work, we present a method to construct over-approximated CFGs for Pure Esterel. Generated CFGs expose invisible interferences among threads and show program structures explicitly so that they are useful for program analyses based on graph theory or control-/data- flows.