Software systems at risk: An empirical study of cloned vulnerabilities in practice
DC Field | Value | Language |
---|---|---|
dc.contributor.author | Kim, Seulbae | - |
dc.contributor.author | Lee, Heejo | - |
dc.date.accessioned | 2021-09-02T07:56:47Z | - |
dc.date.available | 2021-09-02T07:56:47Z | - |
dc.date.created | 2021-06-16 | - |
dc.date.issued | 2018-08 | - |
dc.identifier.issn | 0167-4048 | - |
dc.identifier.uri | https://scholar.korea.ac.kr/handle/2021.sw.korea/73829 | - |
dc.description.abstract | With the growth of open source software (OSS), code clones - code fragments that are copied and pasted within or between software systems- are proliferating. Although code cloning may expedite the process of software development, it often critically affects the security of software because vulnerabilities and bugs can easily be propagated through code clones. These vulnerable code clones are increasing in conjunction with the growth of OSS, potentially contaminating many systems. Although researchers have attempted to detect code clones for decades, most of these attempts fail to scale to the size of the ever-growing OSS code base. The lack of scalability prevents software developers from readily managing code clones and associated vulnerabilities. Moreover, most existing clone detection techniques focus overly on merely detecting clones and this impairs their ability to accurately find "vulnerable" clones. In this paper, we propose VUDDY, an approach for the scalable detection of vulnerable code clones, which is capable of detecting security vulnerabilities in large software programs efficiently and accurately. Its extreme scalability is achieved by leveraging function-level granularity and a length-filtering technique that reduces the number of signature comparisons. This efficient design enables VUDDY to preprocess a billion lines of code in 14 hours and 17 minutes, after which it requires a few seconds to identify code clones. In addition, we designed a vulnerability-preserving abstraction technique that renders VUDDY resilient to common modifications in cloned code, while preserving the vulnerable conditions even after the abstraction is applied. This extends the scope of VUDDY to identifying variants of known vulnerabilities, with high accuracy. An implementation of VUDDY has been serviced online for free at IoTcube, an automated vulnerability detection platform. In this study, we describe its principles, evaluate its efficacy, and analyze the vulnerabilities VUDDY detected in various real-world software systems, such as Apache HTTPD server and an Android smartphone. (C) 2018 Elsevier Ltd. All rights reserved. | - |
dc.language | English | - |
dc.language.iso | en | - |
dc.publisher | ELSEVIER ADVANCED TECHNOLOGY | - |
dc.title | Software systems at risk: An empirical study of cloned vulnerabilities in practice | - |
dc.type | Article | - |
dc.contributor.affiliatedAuthor | Lee, Heejo | - |
dc.identifier.doi | 10.1016/j.cose.2018.02.007 | - |
dc.identifier.scopusid | 2-s2.0-85043451578 | - |
dc.identifier.wosid | 000447358600044 | - |
dc.identifier.bibliographicCitation | COMPUTERS & SECURITY, v.77, pp.720 - 736 | - |
dc.relation.isPartOf | COMPUTERS & SECURITY | - |
dc.citation.title | COMPUTERS & SECURITY | - |
dc.citation.volume | 77 | - |
dc.citation.startPage | 720 | - |
dc.citation.endPage | 736 | - |
dc.type.rims | ART | - |
dc.type.docType | Article | - |
dc.description.journalClass | 1 | - |
dc.description.journalRegisteredClass | scie | - |
dc.description.journalRegisteredClass | scopus | - |
dc.relation.journalResearchArea | Computer Science | - |
dc.relation.journalWebOfScienceCategory | Computer Science, Information Systems | - |
dc.subject.keywordAuthor | Software vulnerability | - |
dc.subject.keywordAuthor | Open source software | - |
dc.subject.keywordAuthor | Vulnerability propagation | - |
dc.subject.keywordAuthor | Code clone detection | - |
dc.subject.keywordAuthor | Vulnerability exploitation | - |
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.
(02841) 서울특별시 성북구 안암로 14502-3290-1114
COPYRIGHT © 2021 Korea University. All Rights Reserved.
Certain data included herein are derived from the © Web of Science of Clarivate Analytics. All rights reserved.
You may not copy or re-distribute this material in whole or in part without the prior written consent of Clarivate Analytics.