Paper Info
Title
LAVA: Large-Scale Automated Vulnerability Addition
Abstract
Work on automating vulnerability discovery has long been hampered by a shortage of ground-truth corpora with which to evaluate tools and techniques. This lack of ground truth prevents authors and users of tools alike from being able to measure such fundamental quantities as miss and false alarm rates. In this paper, we present LAVA, a novel dynamic taint analysis-based technique for producing ground-truth corpora by quickly and automatically injecting large numbers of realistic bugs into program source code. Every LAVA bug is accompanied by an input that triggers it whereas normal inputs are extremely unlikely to do so. These vulnerabilities are synthetic but, we argue, still realistic, in the sense that they are embedded deep within programs and are triggered by real inputs. Using LAVA, we have injected thousands of bugs into eight real-world programs, including bash, tshark, and the GNU coreutils. In a preliminary evaluation, we found that a prominent fuzzer and a symbolic execution-based bug finder were able to locate some but not all LAVA-injected bugs, and that interesting patterns and pathologies were already apparent in their performance. Our work forms the basis of an approach for generating large ground-truth vulnerability corpora on demand, enabling rigorous tool evaluation and providing a high-quality target for tool developers.
Year
DOI
Venue
2016
10.1109/SP.2016.15
2016 IEEE Symposium on Security and Privacy (SP)
Keywords
Field
DocType
large-scale automated vulnerability addition,false alarm rates,dynamic taint analysis-based technique,ground-truth corpora,program source code,GNU coreutils,LAVA-injected bugs,ground-truth vulnerability corpora,tool evaluation,tool developers
Fuzz testing,False alarm,Computer security,Computer science,Source code,Software bug,Taint checking,Symbolic execution,Debugging,Vulnerability
Conference
ISSN
ISBN
Citations 
1081-6011
978-1-5090-0825-4
35
PageRank 
References 
Authors
1.20
10
8
Name
Order
Citations
PageRank
Brendan Dolan-Gavitt136819.94
Patrick Hulin2622.40
Engin Kirda35386334.12
Tim Leek454858.82
Andrea Mambretti5403.29
William Robertson61762123.11
Frederick Ulrich7351.20
Ryan Whelan8622.74