IntFinder: Automatically Detecting Integer Bugs in x86 Binary Program

Chen, Ping; Han, Hao; Wang, Yi; Shen, Xiaobin; Yin, Xia; Mao, Bing; Xie, Lihua

doi:10.1007/978-3-642-11145-7_26

Cited by 14 publications

(11 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…SCAS averaged a 32.3% alert reduction across the three branches of the subject program, but there is no discussion of FNs due to the reduction. INTFINDER [8] used dynamic detection to correctly identify instructions in binary executables that contained integer faults with no false positives.…”

Section: Classification Results Discussionmentioning

confidence: 99%

“…The sophistication of these techniques has increased from a simple alert type selection to hybrid models [8,14], machine learning [22,45], and model checking [44,59]. Nanda et al [39] suggest that deeper analysis of actionable alerts is required beyond current ASAs.…”

Section: Future Workmentioning

confidence: 99%

“…In most trials, PFSM performed better in the number of states generated when compared to the other secondary heuristics. Objectives: Chen et al [8] propose an approach to find integer faults in binary programs via a combination of static and dynamic analyses to achieve the following: (1) find additional integer faults beyond integer overflow, (2) recreate precise types during decompilation, (3) lower the number of ASA generated false positives, and (4) reduce the time to run dynamic analysis while also minimizing false negatives.…”

Section: 4)mentioning

confidence: 99%

“…Additionally, by using static analysis to focus automated test case generation, some of the limitations to automated test case generation, like a large number of generated tests, may be reduced [14]. Other dynamic detection techniques utilize instrumented code to identify concretely incorrect executions [8]. (continued on next page)…”

Section: Dynamic Detectionmentioning

confidence: 99%

“…The ELAN, EFANH, and EFANV AAIT prioritize alerts by their execution likelihood and the prioritizations were compared to the actual execution likelihood as generated by an automated test suite [7]. INTFINDER [8] is evaluated by running the tool on code containing known vulnerabilities.…”

Section: Baseline Comparisonmentioning

confidence: 99%

See 4 more Smart Citations

A systematic literature review of actionable alert identification techniques for automated static code analysis

Heckman

Williams

2011

Information and Software Technology

122

View full text Add to dashboard Cite

a b s t r a c tContext: Automated static analysis (ASA) identifies potential source code anomalies early in the software development lifecycle that could lead to field failures. Excessive alert generation and a large proportion of unimportant or incorrect alerts (unactionable alerts) may cause developers to reject the use of ASA. Techniques that identify anomalies important enough for developers to fix (actionable alerts) may increase the usefulness of ASA in practice. Objective: The goal of this work is to synthesize available research results to inform evidence-based selection of actionable alert identification techniques (AAIT).Method: Relevant studies about AAITs were gathered via a systematic literature review. Results: We selected 21 peer-reviewed studies of AAITs. The techniques use alert type selection; contextual information; data fusion; graph theory; machine learning; mathematical and statistical models; or dynamic detection to classify and prioritize actionable alerts. All of the AAITs are evaluated via an example with a variety of evaluation metrics. Conclusion:The selected studies support (with varying strength), the premise that the effective use of ASA is improved by supplementing ASA with an AAIT. Seven of the 21 selected studies reported the precision of the proposed AAITs. The two studies with the highest precision built models using the subject program's history. Precision measures how well a technique identifies true actionable alerts out of all predicted actionable alerts. Precision does not measure the number of actionable alerts missed by an AAIT or how well an AAIT identifies unactionable alerts. Inconsistent use of evaluation metrics, subject programs, and ASAs in the selected studies preclude meta-analysis and prevent the current results from informing evidence-based selection of an AAIT. We propose building on an actionable alert identification benchmark for comparison and evaluation of AAIT from literature on a standard set of subjects and utilizing a common set of evaluation metrics.

show abstract

Section: Classification Results Discussionmentioning

confidence: 99%