Source Code Analysis Research Articles

Identification and Removal of Software Security Vulnerabilities using Source Code Analysis: A Case Study on a Java File Writer Program with Password Validation Features

We illustrate the use of source code analysis to identify and remove the following software security vulnerabilities: (i) Hardcoded Password, (ii) Empty Password Initialization, (iii) Denial of Service, (iv) System Information Leak, (v) Unreleased Resource and (vi) Path Manipulation. We propose one or more solution approaches to remove or at least mitigate each of these vulnerabilities that have the potential to significantly impact the security of software programs if they are left unattended. In this context, we conduct an exhaustive source code analysis of a file writer program, developed in Java, embedded with features for password validation in order to illustrate the Hardcoded password and Empty password initialization vulnerabilities. We also illustrate the occurrence of one or more new vulnerabilities as a result of incorporating a patch (code) to remove an existing vulnerability. Our solution approaches to remove the above vulnerabilities can also be adapted to other high-level programming languages like C/C++. We use the Fortify Source Code Analyzer (SCA) software to conduct the automated source code analysis of the file writer program to test for software security, including both identification and removal of the vulnerabilities.

Resilient Dynamic Data Driven Application Systems (rDDDAS)

There is a growing interest in Cloud Computing for delivering computing as a utility. Security in Cloud Computing is a challenging research problem because it involves many interdependent tasks including vulnerability scanning, application layer firewalls, configuration management, alert monitoring and analysis, source code analysis, and user identity management. It is widely accepted that we cannot build software and computing systems that are free from vulnerabilities and cannot be penetrated or attacked. Consequently, there is a strong interest in resilience approach because of its potential to address the cybersecurity challenges. Our is based on using the Dynamic Data Driven Application System (DDDAS) and Moving Target Defence (MTD) strategies to develop resilient DDDAS. The Resilient Applications utilize the following capabilities: Software Behaviour Encryption (SBE), Replication, Diversity, Automated Checkpointing and Recovery. Software Behaviour Encryption employs spatiotemporal behaviour encryption and a moving target defence to make active software components change their implementations and their resources randomly and consequently evade attackers. Diversity and random execution is achieved by “hot” shuffling multiple functionally- equivalent, behaviourally-different software versions at runtime (This encryption of the execution environment will make it extremely difficult for an attack to disrupt the normal operations of a cloud application. Also, the dynamic change in the execution environment will hide the software flaws that would otherwise be exploited by a cyberattacker. Checkpointing is used to save the current state of the task to a reliable storage and thus enabling rollback recovery if it is required to tolerate cyberattacks and mitigate their impacts. We use the Compiler for Portable Checkpointing (CPPC), a tool for automatically inserting portable checkpoints into the code.We also evaluate the performance and overhead of running three applications in our rDDDAS environment. Our experimental results show that the rDDDAS environment can be used to develop resilient cloud applications are resilient against attacks with around 7% in execution time overhead.

Fast analysis of source code in C and C++

Static analysis is a popular tool for detecting the vulnerabilities that cannot be found by means of ordinary testing. The main problem in the development of static analyzers is their low speed. Methods for accelerating such analyzers are described, which include incremental analysis, lazy analysis, and header file caching. These methods make it possible to considerably accelerate the detection of defects and to integrate the static analysis tools in the development environment. As a result, defects in a file edited in the Visual Studio development environment can be detected in 0.5 s or faster, which means that they can be practically detected after each keystroke. Therefore, critical vulnerabilities can be detected and corrected at the stage of coding.

A Preliminary Report on Static Analysis of C Code for Nuclear Reactor Protection System

Cybersecurity regulations require new I&C (Instrumentation & Control) systems in nuclear power plants to develop software in accordance with secure software development methodology to prevent the digital systems from cyber attacks. One of the common aspects of various secure software development methodologies is that widely-accepted practices should be followed throughout programming. As PLC (Programmable Logic Controller) is used to implement digital I&Cs, C programs are often translated automatically from design specifications such as FBD programs. This paper tries to analyze a part of preliminary version of C codes of a Korean I&C system with a static source code analysis tool of Microsoft. It shows that the automatic translator from FBD to C had a few critical defects, not concerned with security directly. It also recommends to select appropriate analysis tools and rule sets to check best practices in secure programming, even if the C code is produced mechanically.

IMPEX: An Approach to Analyze Source Code Changes on Software Run Behavior

The development of software nowadays is getting more complex due to the need to use software programs to accomplish more elaborated tasks. Developers may have a hard time knowing what could happen to the software when making changes. To support the developer in reducing the uncertainty of the impact on the software run behavior due to changes in the source code, this paper presents a tool called IMPEX which analyzes the differences in the source code and differences on the run behavior of two subsequent software versions, in the entire repository, demonstrating to the developer the impact that a change in the source code has had on the software run, over the whole software history. This impact helps the developers in knowing what is affected during execution due to their changes in the source code. This study verifies that the software runs that are most impacted by a given change in the source code, have higher chances in being impacted in the future whenever this part of the code is changed again. The approach taken in this paper was able to precisely predict what would be impacted on the software execution when a change in the source code was made in 70% of the cases.

Formal Verification, Engineering and Business Value

How to apply automated verification technology such as model checking and static program analysis to millions of lines of embedded C/C++ code? How to package this technology in a way that it can be used by software developers and engineers, who might have no background in formal verification? And how to convince business managers to actually pay for such a software? This work addresses a number of those questions. Based on our own experience on developing and distributing the Goanna source code analyzer for detecting software bugs and security vulnerabilities in C/C++ code, we explain the underlying technology of model checking, static analysis and SMT solving, steps involved in creating industrial-proof tools.

A reference architecture for organizing the internal structure of metadata-based frameworks

Metadata-based frameworks enable behavior adaptation through the configuration of custom metadata in application classes. Most of the current frameworks used in the industry for building enterprise applications adopt this approach. However, there is a lack of proven techniques for building such kind of framework, allowing for a better organization of its internal structure. In this paper we propose a pattern language and a reference architecture for better organizing the internal structure of metadata-based frameworks, which were defined as a result of a pattern mining process applied to a set of existing open source frameworks. To evaluate the resulting structure generated by the reference architecture application, a case study examined three frameworks developed according to the proposed reference architecture, each one referring to a distinct application domain. The assessment was conducted by using a metrics suite, metrics thresholds derived from a large set of open source metadata-based frameworks, a process for automatic detection of design disharmonies and manual source code analysis. As a result of this study, framework developers can understand and use the proposed reference architecture to develop new frameworks and refactor existing ones. The assessment revealed that the organization provided by the reference architecture is suitable for metadata-based frameworks, helping in the division of responsibility and functionality among their classes.

Automatic data race detection in SystemC models

Systems simulated by using the SystemC language are usually parallel and, therefore, may contain synchronization errors. Data races make up one widespread type of synchronization errors. In this paper, an approach to data race error detection in SystemC programs based on the analysis of the static source code is proposed. Algorithms for analyzing SystemC programs without quantitative time are developed. These algorithms allow one to detect all the data races existing in the program. The efficiency of the approach is proved by the experimental results obtained from using the developed tool meant for error detection for a set of test programs.

High Performance Static Analysis for Industry

Static source code analysis for software bug detection has come a long way since its early beginnings as a compiler technology. However, with the introduction of more sophisticated algorithmic techniques, such as model checking and constraint solving, questions about performance are a major concern. In this work we present an empirical study of our industrial strength source code analysis tool Goanna that uses a model checking core for static analysis of C/C++ code. We present the core technology and abstraction mechanism with a focus on performance, as guided by experience from having analyzed millions of lines of code. In particular, we present results from our recent study within the NIST/DHS SAMATE program. The results show that, maybe surprisingly, formal verification techniques can be used successfully in practical industry applications scaling roughly linearly, even for millions of lines of code.

Variant analysis Reuse potential based on source code analysis

Variant analysis Reuse potential based on source code analysis

Information flow metrics analysis in object oriented programming and metrics validation process by RAA algorithm

Transparent data flow metrics and control flow metrics had no main concern which to be handled by a compiler. Nowadays similar hardware and multithreaded coding is increased. Consequently, both data flow and control flow become more important in analyses the reusability and maintainability. The present analysis of source code and the ability of metrics are incompetent to predict the actual amount of information flow complexity in the modules. In this work, object oriented metric IF-C focuses on the improved information flow complexity estimation method, which is used to evaluate the data flows in object oriented source code and decrease the effort of maintainability and reusability. The object oriented information flow complexity incorporates various internal and external flows in object orientation. The adequacy of software metrics is validated by the rule accuracy algorithm which is based on rule induction technique. The technique applied in the software metrics dataset that has been selected using fitness proportionate selection algorithm. The competence and efficacy of the software metrics have verified by the predefined rules. The rules have if and then clause which hold metrics adequacy standards.

MEGA-CC: computing core of molecular evolutionary genetics analysis program for automated and iterative data analysis

There is a growing need in the research community to apply the molecular evolutionary genetics analysis (MEGA) software tool for batch processing a large number of datasets and to integrate it into analysis workflows. Therefore, we now make available the computing core of the MEGA software as a stand-alone executable (MEGA-CC), along with an analysis prototyper (MEGA-Proto). MEGA-CC provides users with access to all the computational analyses available through MEGA's graphical user interface version. This includes methods for multiple sequence alignment, substitution model selection, evolutionary distance estimation, phylogeny inference, substitution rate and pattern estimation, tests of natural selection and ancestral sequence inference. Additionally, we have upgraded the source code for phylogenetic analysis using the maximum likelihood methods for parallel execution on multiple processors and cores. Here, we describe MEGA-CC and outline the steps for using MEGA-CC in tandem with MEGA-Proto for iterative and automated data analysis. http://www.megasoftware.net/.

Recovering management information from source code

IT has become a production means for many organizations and an important element of business strategy. Even though its effective management is a must, reality shows that this area still remains in its infancy. IT management relies profoundly on relevant information which enables risk mitigation or cost control. However, the needed information is either missing or its gathering boils down to daunting tasks. We propose an approach to recovery of management information from the essence of IT; the software’s source code. In this paper we show how to employ source code analysis techniques and recover management information. In our approach we exploit the potential of the concealed data which resides in the source code statements, source comments, and also compiler listings. We show how to depart from the raw sources, extract data, organize it, and eventually utilize so that the bit level data provides IT executives with support at the portfolio level. Our approach is pragmatic as we rely on real management questions, best practices in software engineering, and also IT market specifics. We enable, for instance, an assessment of the IT-portfolio market value, support for carrying out what-if scenarios, or identification and evaluation of the hidden risks for IT-portfolio maintainability. The study is based on a real-life IT-portfolio which supports business functions of an organization operating in the financial sector. The IT-portfolio comprises Cobol applications run on a mainframe with the total number of lines of code amounting to over 18 million. The approach we propose is suited for facilitation within a large organization. It provides for a fact-based support for strategic decision making at the portfolio level.

Special issue: software maintenance and reengineering (CSMR 2011)

Special issue: software maintenance and reengineering (CSMR 2011)

Sourcerer: An infrastructure for large-scale collection and analysis of open-source code

A large amount of open source code is now available online, presenting a great potential resource for software developers. This has motivated software engineering researchers to develop tools and techniques to allow developers to reap the benefits of these billions of lines of source code. However, collecting and analyzing such a large quantity of source code presents a number of challenges. Although the current generation of open source code search engines provides access to the source code in an aggregated repository, they generally fail to take advantage of the rich structural information contained in the code they index. This makes them significantly less useful than Sourcerer for building state-of-the-art software engineering tools, as these tools often require access to both the structural and textual information available in source code.We have developed Sourcerer, an infrastructure for large-scale collection and analysis of open source code. By taking full advantage of the structural information extracted from source code in its repository, Sourcerer provides a foundation upon which state-of-the-art search engines and related tools can easily be built. We describe the Sourcerer infrastructure, present the applications that we have built on top of it, and discuss how existing tools could benefit from using Sourcerer.

Tackling the Challenges of Evolution in Multiperspective Software Design and Implementation

The design and implementation of software require the usage of different perspectives and views to cope with its static structure, dynamic behavior, and requirements. Artifacts of different views are dependent on each other and subject of frequent changes. Anticipating those changes becomes difficult, as most impact analysis approaches are not designed to work in multiperspective environments. They treat artifacts of different perspectives in isolation, which tends to introduce further inconsistencies and faults. In the related research area of consistency checking, the problem of multiple views has been addressed for a long time and solutions have been developed. We aim on combining the predictive capabilities of impact analysis with the approach of multiperspective consistency checking, to bridge the gap between artifacts of different views. We propose an approach which facilitates impact analysis of different UML models and Java source code. Our approach is based on impact propagation rules, which analyze traceability relations between software artifacts and the type of change applied by a developer.

Finding Vulnerabilities in Rich Internet Applications (Flex/AS3) Using Static Techniques

The number and the importance of Rich Internet Applications (RIA) have increased rapidly over the last years. At the same time, the quantity and impact of security vulnerabilities in such rich internet applications (RIA) have increasing as well. Since manual code reviews are time consuming, error prone and costly and it need skilled developers or programmers to review the manual source code review, the need for automated solutions has become evident. In this paper, we address the problem of application security vulnerable detection in Adobe Flex (Rich Internet Applications) platform in web 2.0 applications by means of static source code analysis. To this end, we present precise analysis targeted at the unique reference semantics commonly found in RIA based web applications or widgets (small applications which will run on fly i.e. drag and drop) developed in Adobe Flex Framework or Action Script 3.0. Moreover, we enhance the quality and quantity of the generated vulnerability reports.

A family of case studies on business process mining using MARBLE

Business processes, most of which are automated by information systems, have become a key asset in organizations. Unfortunately, uncontrolled maintenance implies that information systems age overtime until they need to be modernized. During software modernization, ageing systems cannot be entirely discarded because they gradually embed meaningful business knowledge, which is not present in any other artifact. This paper presents a technique for recovering business processes from legacy systems in order to preserve that knowledge. The technique statically analyzes source code and generates a code model, which is later transformed by pattern matching into a business process model. This technique has been validated over a two-year period in several industrial modernization projects. This paper reports the results of a family of case studies that were performed to empirically validate the technique using analysis and meta-analysis techniques. The family of case studies demonstrates that the technique is feasible in terms of effectiveness and efficiency.

An Effective Visual System for Static Analysis of Source Code

In the software development lifecycle, code static analysis takes an important part in building secure software. To help discover the potential security issues in source code, large numbers of static analysis tools are developed. But the results generated by them display in the form of pure text, so it is time-consuming for developers to analyze these text messages, and it is difficult for developers to concentrate on the most interesting defects in huge data. In this paper, we have developed a visualization system oriented to Java source code, which presents the results in graphics from a developer’s point of view, to help developers to analysis code defects. A novel layout is proposed to visualize software source code in a hierarchy way, which shows the physical structure of the software. A visual overview and powerful interaction is provided in this system which allows the developer to focus on the most pressing defects within huge volumes of source code.

Computer Software-Related Litigation: Discovery and the Overly-Protective Order

Litigation involving allegations of intellectual property infringement concerning computer software is some of the most complex, time consuming, and expensive litigation in which private parties engage. Certain practices in discovery, including, most significantly, the use of poorly drafted discovery agreements that also include “overly protective” orders, increase that expense dramatically. Regardless of whether the allegation is patent infringement, copyright infringement, or trade secret misappropriation, prosecuting and defending the assertions in the case requires a probing analysis of the computer source code. In these types of cases, both parties will engage forensic software analysts to assist the lawyers in preparation for trial and to provide expert witness testimony for the court. The forensic software analysts will dissect the computer source code, often examining the source code of both parties, looking for signs of infringement or misappropriation as well as for technical explanations for similarities in the way the code is written or structured. But first, the computer source code must be disclosed to the opposing party. Such disclosure is almost always done pursuant to a protective order, typically stipulated to by the attorneys. Lawyers often agree to protective orders that significantly and unnecessarily increase the costs of discovery. Attorneys should pay careful attention to the provisions addressing the requirements of production and analysis. Additionally, attorneys must understand the consequences of the clauses contained in protective orders in these types of litigation. As described in this article, it is possible to provide robust protection for disclosed source code while at the same time not unnecessarily and dramatically increasing the cost of discovery by weaponizing the protective order. The goals of this article are three-fold. First, we seek to help lawyers understand the process of forensic software analysis. Second, we provide a set of model clauses aimed at avoiding pitfalls in the design of the discovery process, including model clauses for a protective order of appropriate scope and with appropriate protections from further disclosure of the source code that is produced. Third, for judges who are asked to intervene in discovery battles, including fights over the proper scope of a protective order, this article is meant to assist in evaluating the parties’ arguments.