Logo image
Back
Characterizing the 'security vulnerability likelihood' of software functions
Conference proceeding

Characterizing the 'security vulnerability likelihood' of software functions

D DaCosta, C Dahn, S Mancoridis, V Prevelakis and IEEE COMPUTER SOCIETY
International Conference on Software Maintenance, 2003. ICSM 2003. Proceedings, pp 266-274
2003
DOI: https://doi.org/10.1109/ICSM.2003.1235429

Abstract

Application software Computer languages Open source software Performance evaluation Security Software maintenance Software performance Software systems Software tools Testing
Software maintainers and auditors would benefit from a tool to help them focus their attention on functions that are likely to be the source of security vulnerabilities. However, the existence of such a tool is predicated on the ability to characterize a function's 'security vulnerability likelihood'. Our hypothesis is that functions near a source of input are most likely to contain security vulnerability. These functions should be a small percentage of the total number of functions in the system. To validate this hypothesis, we performed an experiment involving thirty one vulnerabilities in thirty open source systems. This paper describes the experiment, its outcome, and the tools used to conduct it. It also describes the FLF (front line functions) finder, which is a tool that was developed using knowledge gathered from the outcome of the experiment. This tool automates the detection of high-risk functions. To demonstrate the effectiveness of the FLF finder, three open source applications with known vulnerabilities were tested. In addition to this test, a case study was performed on the privilege separation code in the OpenSSH server daemon.

Metrics

14 Record Views
13 citations in Web of Science
31 citations in Scopus

Details

InCites Highlights

Data related to this publication, from InCites Benchmarking & Analytics tool:

Web of Science research areas
Computer Science, Software Engineering
Logo image