CLORIFI: software vulnerability discovery using code clone verification
DC Field | Value | Language |
---|---|---|
dc.contributor.author | Li, Hongzhe | - |
dc.contributor.author | Kwon, Hyuckmin | - |
dc.contributor.author | Kwon, Jonghoon | - |
dc.contributor.author | Lee, Heejo | - |
dc.date.accessioned | 2021-09-04T00:26:13Z | - |
dc.date.available | 2021-09-04T00:26:13Z | - |
dc.date.created | 2021-06-17 | - |
dc.date.issued | 2016-04-25 | - |
dc.identifier.issn | 1532-0626 | - |
dc.identifier.uri | https://scholar.korea.ac.kr/handle/2021.sw.korea/88899 | - |
dc.description.abstract | Software vulnerability has long been considered an important threat to the system safety. A vulnerability is often reproduced because of the frequent code reuse by programmers. Security patches are usually not propagated to all code clones; however, they could be leveraged to discover unknown vulnerabilities. Static code auditing approaches are frequently proposed to scan source codes for security flaws; unfortunately, these approaches generate too many false positives. While dynamic execution analysis methods can precisely report vulnerabilities, they are ineffective in path exploration, which limits them to scale to large programs. With the purpose of detecting vulnerability in a scalable way with more preciseness, in this paper, we propose a novel mechanism, called software vulnerability discovery using Code Clone Verification (CLORIFI), that scalably discovers vulnerabilities in real world programs using code clone verification. In the beginning, we use a fast and scalable syntax-based way to find code clones in program source codes based on released security patches. Subsequently, code clones are being verified using concolic testing to dramatically decrease the false positives. In addition, we mitigate the path explosion problem by backward sensitive data tracing in concolic execution. Experiments have been conducted with real-world open-source projects (recent Linux OS distributions and program packages). As a result, we found 7 real vulnerabilities out of 63 code clones from Ubuntu 14.04 LTS (Canonical, London, UK) and 10 vulnerabilities out of 40 code clones from CentOS 7.0 (The CentOS Project(community contributed)). Furthermore, we confirmed more code clone vulnerabilities in various versions of programs including Rsyslog (Open Source(Original author: Rainer Gerhards)), Apache (Apache Software Foundation, Forest Hill, Maryland, USA) and Firefox (Mozilla Corporation, Mountain View, California, USA). In order to evaluate the effectiveness of vulnerability verification in a systematic way, we also utilized Juliet Test Suite as measurement objects. The results show that CLORIFI achieves 98% accuracy with 0 false positives. Copyright (C) 2015 John Wiley & Sons, Ltd. | - |
dc.language | English | - |
dc.language.iso | en | - |
dc.publisher | WILEY | - |
dc.title | CLORIFI: software vulnerability discovery using code clone verification | - |
dc.type | Article | - |
dc.contributor.affiliatedAuthor | Lee, Heejo | - |
dc.identifier.doi | 10.1002/cpe.3532 | - |
dc.identifier.scopusid | 2-s2.0-84930531814 | - |
dc.identifier.wosid | 000374011400015 | - |
dc.identifier.bibliographicCitation | CONCURRENCY AND COMPUTATION-PRACTICE & EXPERIENCE, v.28, no.6, pp.1900 - 1917 | - |
dc.relation.isPartOf | CONCURRENCY AND COMPUTATION-PRACTICE & EXPERIENCE | - |
dc.citation.title | CONCURRENCY AND COMPUTATION-PRACTICE & EXPERIENCE | - |
dc.citation.volume | 28 | - |
dc.citation.number | 6 | - |
dc.citation.startPage | 1900 | - |
dc.citation.endPage | 1917 | - |
dc.type.rims | ART | - |
dc.type.docType | Article | - |
dc.description.journalClass | 1 | - |
dc.description.journalRegisteredClass | scie | - |
dc.description.journalRegisteredClass | scopus | - |
dc.relation.journalResearchArea | Computer Science | - |
dc.relation.journalWebOfScienceCategory | Computer Science, Software Engineering | - |
dc.relation.journalWebOfScienceCategory | Computer Science, Theory & Methods | - |
dc.subject.keywordAuthor | software vulnerability | - |
dc.subject.keywordAuthor | code clone | - |
dc.subject.keywordAuthor | concolic testing | - |
dc.subject.keywordAuthor | vulnerability verification | - |
Items in ScholarWorks are protected by copyright, with all rights reserved, unless otherwise indicated.
(02841) 서울특별시 성북구 안암로 14502-3290-1114
COPYRIGHT © 2021 Korea University. All Rights Reserved.
Certain data included herein are derived from the © Web of Science of Clarivate Analytics. All rights reserved.
You may not copy or re-distribute this material in whole or in part without the prior written consent of Clarivate Analytics.