C/C++ 프로그램을 위한 진단 정보와 분석 방법의 분류
Classification of Diagnostic Information and Analysis Methods for Weaknesses in C/C++ Programs
1
조회
0
다운로드
1
인용
0
참고문헌
키워드
초록
In this paper, we classified the weaknesses of C/C++ programs listed in CWE based on the diagnostic information produced at each stage of program compilation. Our classification identifies which stages should be responsible for analyzing the weaknesses. We also present algorithmic frameworks for detecting typical weaknesses belonging to the classes to demonstrate validness of our scheme. For the weaknesses that cannot be analyzed by using the diagnostic information, we separated them as a group that are often detectable by the analyses that simulate program execution, for instance, symbolic execution and abstract interpretation. We expect that classification of weaknesses, and diagnostic information accordingly, would contribute to systematic development of static analyzers that minimizes false positives and negatives.
Abstract
In this paper, we classified the weaknesses of C/C++ programs listed in CWE based on the diagnostic information produced at each stage of program compilation. Our classification identifies which stages should be responsible for analyzing the weaknesses. We also present algorithmic frameworks for detecting typical weaknesses belonging to the classes to demonstrate validness of our scheme. For the weaknesses that cannot be analyzed by using the diagnostic information, we separated them as a group that are often detectable by the analyses that simulate program execution, for instance, symbolic execution and abstract interpretation. We expect that classification of weaknesses, and diagnostic information accordingly, would contribute to systematic development of static analyzers that minimizes false positives and negatives.
참고문헌 (11)
- "Common Weakness Enumeration"[URL]
- "NIST"[URL]
- SAMATE, "Juliet Test Suite v1.2 for C", C++ User Guide
- "SecurityPrism"[URL]
- Hyun-Joon Kwon, "Developing An Automatic Tool for Static Detection of Software Security Vulnerabilities", KIISE, 28(2), pp.37~40 (2010)
- Hyunha Kim, "Rule-based Source-code Analysis for Detection of Security Vulnerability", WISA2009:The 10th International Workshop on Information Security Applications (2009)
- "Fortify Static Code Analyzer"[URL]
- Alfred V. Aho, "Compilers: Principled, Techniques, and Tools" (1986), Addison Wesley
- Steven S. Muchnick, "Advanced Compiler Design and Implementation", pp.169~265 (1997), Morgan Kaufmann
- C. Cadar, "Symbolic execution for software testing: three decades later", Communications of the ACM, 56(2), pp.82~90 (2013)
- P. Cousot, "Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints", Proceedings of the 4th ACM SIGACT- SIGPLAN symposium on Principles of programming languages, pp.238~252 (1977), ACM