Understanding C programs using the Combined C Graph representation

Kinloch,; Munro,

doi:10.1109/icsm.1994.336777

Cited by 23 publications

(14 citation statements)

References 7 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A related strain of research has followed a more principled approach by modeling and inferring security policies [e.g., 6,36,52,57] for discovering informationflow vulnerabilities. Similar to our method, many of these approaches are based on syntax trees and code slices as well as representations that combine syntax, control flow, and datadependence relationships [e.g., 27,29].…”

Section: Related Workmentioning

confidence: 99%

Automatic Inference of Search Patterns for Taint-Style Vulnerabilities

Yamaguchi

Maier

Gascón

et al. 2015

2015 IEEE Symposium on Security and Privacy

150

View full text Add to dashboard Cite

Taint-style vulnerabilities are a persistent problem in software development, as the recently discovered "Heartbleed" vulnerability strikingly illustrates. In this class of vulnerabilities, attacker-controlled data is passed unsanitized from an input source to a sensitive sink. While simple instances of this vulnerability class can be detected automatically, more subtle defects involving data flow across several functions or projectspecific APIs are mainly discovered by manual auditing. Different techniques have been proposed to accelerate this process by searching for typical patterns of vulnerable code. However, all of these approaches require a security expert to manually model and specify appropriate patterns in practice.In this paper, we propose a method for automatically inferring search patterns for taint-style vulnerabilities in C code. Given a security-sensitive sink, such as a memory function, our method automatically identifies corresponding source-sink systems and constructs patterns that model the data flow and sanitization in these systems. The inferred patterns are expressed as traversals in a code property graph and enable efficiently searching for unsanitized data flows-across several functions as well as with project-specific APIs. We demonstrate the efficacy of this approach in different experiments with 5 open-source projects. The inferred search patterns reduce the amount of code to inspect for finding known vulnerabilities by 94.9% and also enable us to uncover 8 previously unknown vulnerabilities.

show abstract

Section: Related Workmentioning

confidence: 99%

Automatic Inference of Search Patterns for Taint-Style Vulnerabilities

Yamaguchi

Maier

Gascón

et al. 2015

2015 IEEE Symposium on Security and Privacy

150

View full text Add to dashboard Cite

show abstract

“…Algorithms such as those to calculate data flow information and program slices involve the use of intermediate graphbased program representations, while symbolic execution requires the same syntactic and semantic information (often represented by annotated abstract syntax trees) as compilers and interpreters (Aho, Sethi and Ullmann, 1986). The intermediate program representation used in the specification driven program slicing process for C programs is the Combined C Graph (CCG) introduced by Kinloch and Munro (1994). The CCG extends the work by Harrold and Malloy (1993) for combining the features of different program representations into a single unified intermediate representation for a maintenance environment.…”

Section: A Program Representation For C Programsmentioning

confidence: 99%

“…A more complete discussion is contained in Kinloch and Munro (1994). As an example, let us consider the following simple program…”

Section: The Combined C Graphmentioning

confidence: 99%

A Specification Driven Slicing Process for Identifying Reusable Functions

CIMITILE¹,

LUCIA²,

Munro³

1996

J. Softw. Maint: Res. Pract.

View full text Add to dashboard Cite

SUMMARYWe present a new program slicing process for identifying and extracting code fragments implementing functional abstractions. The process is driven by the specification of the function to be isolated, given in terms of a precondition and a postcondition. Symbolic execution techniques are used to abstract the preconditions for the execution of program statements and predicates. The recovered conditions are then compared with the precondition and the postcondition of the functional abstraction. The statements whose preconditions are equivalent to the pre and postconditions of the specification are candidate to be the entry and exit points of the slice implementing the abstraction. Once the slicing criterion has been identified the slice is isolated using algorithms based on dependence graphs. The process has been specialized for programs written in the C language. Both symbolic execution and program slicing are performed by exploiting the Combined C Graph (CCG), a fine-grained dependence based program representation that can be used for most software maintenance tasks.The work described in this paper is part of REZ, a research project aiming to explore reverse engineering and re-engineering techniques for reusing software components from existing systems.

show abstract

“…Moreover, creating new representations specifically to aid in bug finding and program understanding has been considered by Kinloch and Munro [19]. They present the Combined C Graph (CCG), which, in essence, is a system-wide program dependence graph.…”

Section: Related Workmentioning

confidence: 99%

Modeling and Discovering Vulnerabilities with Code Property Graphs

Yamaguchi

Golde²,

Arp

et al. 2014

2014 IEEE Symposium on Security and Privacy

520

264

View full text Add to dashboard Cite

Abstract-The vast majority of security breaches encountered today are a direct result of insecure code. Consequently, the protection of computer systems critically depends on the rigorous identification of vulnerabilities in software, a tedious and errorprone process requiring significant expertise. Unfortunately, a single flaw suffices to undermine the security of a system and thus the sheer amount of code to audit plays into the attacker's cards. In this paper, we present a method to effectively mine large amounts of source code for vulnerabilities. To this end, we introduce a novel representation of source code called a code property graph that merges concepts of classic program analysis, namely abstract syntax trees, control flow graphs and program dependence graphs, into a joint data structure. This comprehensive representation enables us to elegantly model templates for common vulnerabilities with graph traversals that, for instance, can identify buffer overflows, integer overflows, format string vulnerabilities, or memory disclosures. We implement our approach using a popular graph database and demonstrate its efficacy by identifying 18 previously unknown vulnerabilities in the source code of the Linux kernel.

show abstract

Understanding C programs using the Combined C Graph representation

Cited by 23 publications

References 7 publications

Automatic Inference of Search Patterns for Taint-Style Vulnerabilities

Automatic Inference of Search Patterns for Taint-Style Vulnerabilities

A Specification Driven Slicing Process for Identifying Reusable Functions

Modeling and Discovering Vulnerabilities with Code Property Graphs

Contact Info

Product

Resources

About