NDLI: Convicting exploitable software vulnerabilities: An efficient input provenance based approach

Content Provider	IEEE Xplore Digital Library
Author	Zhiqiang Lin Xiangyu Zhang Dongyan Xu
Copyright Year	2008
Description	Author affiliation: Dept. of Comput. Sci. & CERIAS, Purdue Univ., West Lafayette, IN (Zhiqiang Lin; Xiangyu Zhang; Dongyan Xu)
Abstract	Software vulnerabilities are the root cause of a wide range of attacks. Existing vulnerability scanning tools are able to produce a set of suspects. However, they often suffer from a high false positive rate. Convicting a suspect and vindicating false positives are mostly a highly demanding manual process, requiring a certain level of understanding of the software. This limitation significantly thwarts the application of these tools by system administrators or regular users who are concerned about security but lack of understanding of, or even access to, the source code. It is often the case that even developers are reluctant to inspect/fix these numerous suspects unless they are convicted by evidence. In this paper, we propose a lightweight dynamic approach which generates evidence for various security vulnerabilities in software, with the goal of relieving the manual procedure. It is based on data lineage tracing, a technique that associates each execution point precisely with a set of relevant input values. These input values can be mutated by an offline analysis to generate exploits. We overcome the efficiency challenge by using Binary Decision Diagrams (BDD). Our tool successfully generates exploits for all the known vulnerabilities we studied. We also use it to uncover a number of new vulnerabilities, proved by evidence.
Starting Page	247
Ending Page	256
File Size	965092
Page Count	10
File Format	PDF
ISBN	9781424423972
DOI	10.1109/DSN.2008.4630093
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2008-06-24
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Software Data structures Boolean functions Runtime Conferences Equations Detectors
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Convicting exploitable software vulnerabilities: An efficient input provenance based approach (2008)

Convicting exploitable software vulnerabilities: an efficient input provenance based approach.

Convicting Exploitable Software Vulnerabilities: An Efficient Input Provenance Based Approach (2008)

An efficient code audit method for accurately detecting security vulnerabilities in source codes

Read-polarity-once Boolean functions

Detection of symmetry of Boolean functions represented by ROBDDs

Efficient canonical form for Boolean matching of complex functions in large libraries

Efficient path conditions in dependence graphs

Efficient solution of language equations using partitioned representations

Convicting exploitable software vulnerabilities: An efficient input provenance based approach

Similar Documents

Convicting exploitable software vulnerabilities: An efficient input provenance based approach (2008)

Convicting exploitable software vulnerabilities: an efficient input provenance based approach.

Convicting Exploitable Software Vulnerabilities: An Efficient Input Provenance Based Approach (2008)

An efficient code audit method for accurately detecting security vulnerabilities in source codes

Read-polarity-once Boolean functions

Detection of symmetry of Boolean functions represented by ROBDDs

Efficient canonical form for Boolean matching of complex functions in large libraries

Efficient path conditions in dependence graphs

Efficient solution of language equations using partitioned representations

Convicting exploitable software vulnerabilities: An efficient input provenance based approach