PhD8: Use analysis techniques to evaluate and improve vulnerability detection
Title: Use analysis techniques to evaluate and improve vulnerability detection
Advisors:
Abstract:
Automated vulnerability detection tools are widely used by developers to disclose security vulnerabilities. The lack of security training and the cost of using specialized resources frequently lead development teams to "blindly" rely on the outputs of those tools, but research and practice shows that the effectiveness of existing tools is far from satisfactory. As using more than one is not an option due to license costs and conflicting results, developers usually are asked to select just one tool and trust the results that it produces. However, selecting the most adequate vulnerability detection tool for a given scenario can be a very challenging task.
This context highlights the need to provide developers with improved tools and methodologies to assess the quality of these tools, selecting the best ones to use in each scenario. Recent work in collaboration between UNICAMP and UC shows that using of analysis techniques is an effective way to assess vulnerability detection tools and to improve their effectiveness. The analysis techniques available include (but are not limited to) code coverage analysis, static code analysis, dynamic analysis, runtime anomaly detection, sequence alignment, modeling techniques, etc.
The objectives of this PhD work are to research ways to improve vulnerability detection techniques by integrating different analysis techniques and also to use the results of these techniques to define approaches to evaluate and compare vulnerability detection techniques.
The improvement of vulnerability detection techniques can be done by improving the quality of the tests generated and by improving the vulnerability identification approaches. Code coverage analysis and static code analysis can help guiding the test generation as they allow to understand which parts of the code are not being tested and what should be the application inputs that will allow testing those parts of code. Meanwhile, as the tests are executed, it is possible to refine the results of the analysis, resulting in a feedback loop that allows the continuous improvement of the vulnerability detection results. Finally, other analysis techniques as runtime anomaly detection and sequence alignment can be used to improve the vulnerability identification.
In terms of evaluation and comparison of the techniques, the strategy is to use analysis techniques to gather evidences on the quality of the vulnerability detection techniques results. By using them in standard procedures, it is possible to define benchmarks that can be used to evaluate and compare different vulnerability detection techniques according to specific characteristics and selecting the ones that best fit each scenario. And finally, with these benchmarks it will be possible to evaluate the improvements introduced by the analysis techniques.
Bibliography:
- Ana Paula Matsunaga, Code Coverage Analysis to Improve Vulnerability Detection, to appear.
- Balzarotti, D., Cova, M., Felmetsger, V., Jovanovic, N., Kirda, E., Kruegel, C., & Vigna, G. (2008). Saner: Composing Static and Dynamic Analysis to Validate Sanitization in Web Applications. In IEEE Symposium on Security and Privacy, 2008. SP 2008 (Vol. 66, pp. 387–401). doi:10.1109/SP.2008.22
- Yang, Q., Li, J. J., & Weiss, D. M. (2009). A Survey of Coverage-Based Testing Tools. The Computer Journal, 52(5), 589–597. doi:10.1093/comjnl/bxm021
- Antunes, N., Laranjeiro, N., Vieira, M., & Madeira, H. (2009). Effective Detection of SQL/XPath Injection Vulnerabilities in Web Services. In 2009 IEEE International Conference on Services Computing (SCC 2009) (pp. 260–267). Bangalore, India. doi:10.1109/SCC.2009.23
- Antunes, N., & Vieira, M. (2014). Assessing and Comparing Vulnerability Detection Tools for Web Services: Benchmarking Approach and Examples. IEEE Transactions on Services Computing, Early Access Online. doi:10.1109/TSC.2014.2310221
This page corresponds to a PhD proposal that will be Co-Advised by experienced researchers of at least two of the partners of the project. If you are interested in pursuing this proposal, please contact us at This email address is being protected from spambots. You need JavaScript enabled to view it.
