Automatic Mining of Security-Sensitive Functions from Source Code

• 作者: Chunfang Yang Daofu Gong Fenlin Liu Lin Chen Shichang Ding
• 来源期刊: 计算机、材料和连续体(英文)
• 学科: 工学
• 关键词: CODE MINING VULNERABILITIES STATIC analysis security-sensitive function source code.
• 年，卷（期）: 2018,（8）
• 页码范围: 199-210
• 页数: 12页
• 分类号: TP3

摘要

When dealing with the large-scale program,many automatic vulnerability mining techniques encounter such problems as path explosion,state explosion,and low efficiency.Decomposition of large-scale programs based on safety-sensitive functions helps solve the above problems.And manual identification of security-sensitive functions is a tedious task,especially for the large-scale program.This study proposes a method to mine security-sensitive functions the arguments of which need to be checked before they are called.Two argument-checking identification algorithms are proposed based on the analysis of two implementations of argument checking.Based on these algorithms,security-sensitive functions are detected based on the ratio of invocation instances the arguments of which have been protected to the total number of instances.The results of experiments on three well-known open-source projects show that the proposed method can outperform competing methods in the literature.