|
Published Articles >> Table of Contents >> Abstract
19th IEEE International Conference on Software Maintenance (ICSM'03)
p. 266
Characterizing the 'Security Vulnerability Likelihood' of Software Functions
Dan DaCosta, Drexel University
Christopher Dahn, Drexel University
Spiros Mancoridis, Drexel University
Vassilis Prevelakis, Drexel University
Full Article Text:
  
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/ICSM.2003.1235429
Send link to a friend
| Abstract |
|
Software maintainers and auditors would benefit from a tool to help them focus their attention on functions that are likely to be the source of security vulnerabilities. However, the existence of such a tool is predicated on the ability to characterize a function's 'security vulnerability likelihood.' Our hypothesis is that functions near a source of input are most likely to contain a security vulnerability. These functions should be a small percentage of the total number of functions in the system. To validate this hypothesis, we performed an experiment involving thirty one vulnerabilities in thirty open source systems. This paper describes the experiment, its outcome, and the tools used to conduct it. It also describes the FLF Finder, which is a tool that was developed using knowledge gathered from the outcome of the experiment. This tool automates the detection of high-risk functions. To demonstrate the effectiveness of the FLF Finder, three open source applications with known vulnerabilities were tested. In addition to this test, a case study was performed on the privilege separation code in the OpenSSH server daemon.
|
 Additional Information
|
Citation:
Dan DaCosta, Christopher Dahn, Spiros Mancoridis, Vassilis Prevelakis,
"Characterizing the 'Security Vulnerability Likelihood' of Software Functions,"
icsm,
p. 266,
19th IEEE International Conference on Software Maintenance (ICSM'03),
2003
|
|
