NDLI: Modeling and Discovering Vulnerabilities with Code Property Graphs

Content Provider	IEEE Xplore Digital Library
Author	Yamaguchi, F. Golde, N. Arp, D. Rieck, K.
Copyright Year	2014
Description	Author affiliation: Qualcomm Res. Germany, Germany (Golde, N.) \|\| Univ. of Gottingen, Göttingen, Germany (Yamaguchi, F.; Arp, D.; Rieck, K.)
Abstract	The vast majority of security breaches encountered today are a direct result of insecure code. Consequently, the protection of computer systems critically depends on the rigorous identification of vulnerabilities in software, a tedious and error-prone process requiring significant expertise. Unfortunately, a single flaw suffices to undermine the security of a system and thus the sheer amount of code to audit plays into the attacker's cards. In this paper, we present a method to effectively mine large amounts of source code for vulnerabilities. To this end, we introduce a novel representation of source code called a code property graph that merges concepts of classic program analysis, namely abstract syntax trees, control flow graphs and program dependence graphs, into a joint data structure. This comprehensive representation enables us to elegantly model templates for common vulnerabilities with graph traversals that, for instance, can identify buffer overflows, integer overflows, format string vulnerabilities, or memory disclosures. We implement our approach using a popular graph database and demonstrate its efficacy by identifying 18 previously unknown vulnerabilities in the source code of the Linux kernel.
Starting Page	590
Ending Page	604
File Size	314469
Page Count	15
File Format	PDF
ISBN	9781479946860
ISSN	10816011
DOI	10.1109/SP.2014.44
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2014-05-18
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Syntactics Security Abstracts Joints Databases Kernel Graph Databases Vulnerabilities Static Analysis
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Modeling and visualizing security properties of code using dependence graphs (2005).

A program vulnerabilities detection frame by static code analysis and model checking

Modeling and Discovering Vulnerabilities with Code Property Graphs

Automatic Inference of Search Patterns for Taint-Style Vulnerabilities

Modeling and Discovering Vulnerabilities with Code Property Graphs

Static analysis of machine code for supply-chain risk management

Static Code Analysis for Software Security Verification: Problems and Approaches

Ownership Object Graphs with Dataflow Edges

Static Detection of User-specified Security Vulnerabilities in Client-side JavaScript

Modeling and Discovering Vulnerabilities with Code Property Graphs

Similar Documents

Modeling and visualizing security properties of code using dependence graphs (2005).

A program vulnerabilities detection frame by static code analysis and model checking

Modeling and Discovering Vulnerabilities with Code Property Graphs

Automatic Inference of Search Patterns for Taint-Style Vulnerabilities

Modeling and Discovering Vulnerabilities with Code Property Graphs

Static analysis of machine code for supply-chain risk management

Static Code Analysis for Software Security Verification: Problems and Approaches

Ownership Object Graphs with Dataflow Edges

Static Detection of User-specified Security Vulnerabilities in Client-side JavaScript

Modeling and Discovering Vulnerabilities with Code Property Graphs