Name
Abstract | ||
|---|---|---|
Software maintainers and auditors would benefit from a tool to help them focus their attention on functions that are likely to be the source of security vulnerabilities. However, the existence of such a tool is predicated on the ability to characterize a function's 'security vulnerability likelihood'. Our hypothesis is that functions near a source of input are most likely to contain security vulnerability. These functions should be a small percentage of the total number of functions in the system. To validate this hypothesis, we performed an experiment involving thirty one vulnerabilities in thirty open source systems. This paper describes the experiment, its outcome, and the tools used to conduct it. It also describes the FLF (front line functions) finder, which is a tool that was developed using knowledge gathered from the outcome of the experiment. This tool automates the detection of high-risk functions. To demonstrate the effectiveness of the FLF finder, three open source applications with known vulnerabilities were tested. In addition to this test, a case study was performed on the privilege separation code in the OpenSSH server daemon. |
Year | DOI | Venue |
|---|---|---|
2003 | 10.1109/ICSM.2003.1235429 | ICSM |
Keywords | Field | DocType |
front line functions,security vulnerability,flf finder,open source application,open source systems,software functions,outcome ofthe experiment,software vulnerability,software tools,security vulnerability likelihood,software maintenance,opensshserver daemon,case study,software maintainance,software auditing,ability tocharacterize,openssh server daemon,vulnerabilitiesin thirty,formal specification,security of data,open source system | Privilege separation,Vulnerability (computing),Systems engineering,Computer science,Software security assurance,Software system,Artificial intelligence,Backporting,Software sizing,Software engineering,Vulnerability management,Software quality,Machine learning | Conference |
ISSN | ISBN | Citations |
1063-6773 | 0-7695-1905-9 | 22 |
PageRank | References | Authors |
3.12 | 12 | 4 |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Dan DaCosta | 1 | 22 | 3.45 |
| Christopher Dahn | 2 | 43 | 4.30 |
| Spiros Mancoridis | 3 | 888 | 56.82 |
| Vassilis Prevelakis | 4 | 442 | 39.69 |