소스 코드 난독화 기법에 의한 Clang 정적 분석 도구의 성능 영향 분석
Analysis of Detection Ability Impact of Clang Static Analysis Tool by Source Code Obfuscation Technique
0
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
사물 인터넷 시장 규모의 급격한 성장에 따라 임베디드 시스템에서 가장 많이 쓰이는 언어인 C/C++ 언어의 사용도 증가하고 있다. C/C++ 언어의 코드 품질을 향상시키고 개발 비용을 절감시키기 위해 소프트웨어 개발 전반부에서 수행 가능한 소프트웨어 검증기법인 정적 분석을 사용하는 것이 좋다. 많은 프로그램들이 정적 분석을 사용하여 소프트웨어의 안전성을 검증하고 있으며 많은 정적 분석 도구들이 사용 및 연구되고 있다. 본 논문에서는 Clang 정적 분석도구를 사용하여 검증된 시험 코드에 대한 보안 약점 검출 성능을 확인한다. 또한 소스 코드 난독화 기법인 구획 난독화, 데이터 난독화, 제어 흐름 난독화 기법이 각각 적용된 시험 코드에 대한정적 분석 결과와 원본 시험 코드에 대한 정적 분석 결과를 비교하여 소스 코드 난독화 기법에 따른 Clang 정적 분석 도구의 성능 영향을 분석한다.
Abstract
Due to the rapid growth of the Internet of Things market, the use of the C/C++ language, which is the most widelyused language in embedded systems, is also increasing. To improve the quality of code in the C/C++ language and reducedevelopment costs, it is better to use static analysis, a software verification technique that can be performed in the first halfof the software development life cycle. Many programs use static analysis to verify software safety and many static analysistools are being used and studied. In this paper, we use Clang static analysis tool to check security weakness detection performance of verified test code. Inaddition, we compared the static analysis results of the test codes applied with the source obfuscation techniques, layoutobfuscation, data obfuscation, and control flow obfuscation techniques, and the static analysis results of the original testcodes, Analyze the detection ability impact of the Clang static analysis tool.
참고문헌 (32)
- "IHS Markit"[URL]
- [URL]
- C. Lattner, "LLVM: A compilation framework for lifelong program analysis & transformation", International Symposium on. IEEE, pp.75~86 (2004)
- [URL]
- "SAMATE Software Assurance Reference Dataset"[URL]
- [URL]
- [URL]
- A Taxonomy of Obfuscating Transformations. Technical Report 148, "C. Collberg", Department of Computer Science, University of Auckland, ~ (1997)
- C. Wang, "A Security Architecture of Survivability Mechanisms", pp.2000
- [URL]
- G. Wroblewski, "General Method of Program Code Obfuscation", pp.2002
- [URL]
- M. Barr, "Programming Embedded Systems in C and C++" (1999), O'Reilly & Associates, Inc.
- T. Nakashima, "Analysis of software bugcauses and its prevention", Information and Software Technology, 41(15), pp.1059~1068 (1999)[DOI]
- V. Mashayekhi, "Distributed, Collaborative Software Inspections", IEEE Software, 10(5), pp.66~75 (1993)
- R. Shirey, "Internet Security Glossary, RFC 2828", Internet Engineering Task Force, ~ (2000)
- H. Wang, "Shield: Vulnerability-driven network filters for preventing known vulnerability exploits", Proceedings of ACM SIGCOMM (2004)
- [URL]
- [URL]
- N. Ayewah, "Using Static Analysis to Find Bugs", IEEE Software, 25(5), pp.22~29 (2008)
- [URL]
- K. Vorobyov, "Comparing Model Checking and Static Program Analysis: A Case Study in Error Detection Approaches", Proc. 5th Int. Workshop Syst. Softw. Verification, pp.1~7 (2010)
- D. Kroening, "CBMC-C bounded model checker", International Conference on Tools and Algorithms for Construction and Analysis of Systems, pp.389~391 (2014)
- C. Cifuentes, "Parfait - designing a scalable bug checker", Proceedings of the ACM SIGPLAN Static Analysis Workshop, pp.4~11 (2008)
- Static Analysis Tool Exposition(SATE) 2008, NIST Special Publication 500-279, "V. Okun", National Institute of Standards and Technology, ~ (2009)
- The Second Static Analysis Tool Exposition (SATE) 2009, NIST Special Publication 500-287, "V. Okun", National Institute of Standards and Technology, ~ (2010)
- Report on the Third Static Analysis Tool Exposition (SATE) 2010, NIST Special Publication 500-283, "V. Okun", National Institute of Standards and Technology, ~ (2011)
- Report on the Static Analysis Tool Exposition (SATE) IV, NIST Special Publication 500-297, "V. Okun", National Institute of Standards and Technology, ~ (2013)
- [URL]
- D.E. Bakke, "Data obfuscation: Anonymity and desensitization of usable data sets", IEEE Security and Privacy, 2(6), pp.34~41 (2004)[DOI]
- T.W. Hou, "Three Control Flow Obfuscation methods for Java Software", IEE Proceedings Software, 153(2), pp.80~86 (2006)[DOI]
- C. Collberg, "Manufacturing cheap, resilient, and stealthy opaque constructs", Proc. 25th. ACM Symposium on Principles of Programming Languages (POPL 1998), pp.184~196 (1998)