A Method for Computer Software Security Detection

Abstract:

This paper proposed a method and a prototype using static analysis to detect security of computer software. There are many buffer overflow vulnerabilities in released software. It uses the static object code analysis technology to detect buffer overflow, and analysis some unsafe function to determine whether the software has some default. It compares the different results of the proposed tool and traditional buffer overflow detecting tools, the false alarm rate is less than others, false negative rate is same as others.

• Periodical: Advanced Materials Research (Volumes 403-408)
• Pages: 2981-2984
• DOI: https://doi.org/10.4028/www.scientific.net/AMR.403-408.2981
• Online since: November 2011
• Authors: Yong Cheng, Ling Yang, Wen Jia Jin, Wen Zhong Yang, Wei Wang, Feng Wang, Yong Zhou
• Keywords: Buffer Overflow Detection, Object Code, Static Analysis, Unsafe Function

References

[1] Aishwarya Iyer, Lorie M. Liebrock. Vulnerability Scanning for Buffer Overflow, Proceedings of the International Conference on Information Technology: Coding and Computing (ITCC'04), Las Vegas, Nevada, USA. p.116~117. (2004).

DOI: 10.1109/itcc.2004.1286600

[2] Ying-Dar Lin, Fan-Cheng Wu, Tze-Yau Huang, et al. Embedded TaintTracker: Lightweight Tracking of Taint Data against Buffer Overflow Attacks, 2010 IEEE International Conference on Communications (ICC), Cape Town, South Africa, p.1~5. (2010).

DOI: 10.1109/icc.2010.5501974

[3] Eric Haugh, Matt Bishop. Testing C Programs for Buffer Overflow Vulnerabilities. in: M. Tripunitara ed. Proceedings of the 10th Network and Distributed System Security Symposium. San Diego, California, USA. p.361~368. ( 2003).

[4] C. Cowan, P. Wagle, C. Pu et al. Buffer overflow: Attacks and defenses for the vulnerability of the decade. DARPA Information Survivability. 16(7). p.119~129. (2000).

DOI: 10.1109/discex.2000.821514