基于静态检测的程序安全漏洞测试

孙茜1;宫云战2杨朝红2,3

北京化工大学学报(自然科学版) ›› 2007, Vol. 34 ›› Issue (s1) : 9-12.

PDF(440 KB)
欢迎访问北京化工大学学报(自然科学版),今天是 2025年7月18日 星期五
Email Alert  RSS
PDF(440 KB)
北京化工大学学报(自然科学版) ›› 2007, Vol. 34 ›› Issue (s1) : 9-12.
综述

基于静态检测的程序安全漏洞测试

  • 孙茜;宫云战杨朝红,
作者信息 +

JOURNAL OF BEIJING UNIVERSITY OF CHEMICAL TECHNOLOGY

  • SUN Qian1;GONG YunZhan2;YANG ZhaoHong2,3
Author information +
文章历史 +

摘要

静态分析方法可以自动地提取软件的行为信息,从而检测出软件中的安全漏洞。和其他程序分析方法相比,该方法具有自动化程度高和检测速度快的优点。本文介绍了Java语言的安全漏洞的故障模式,说明了类型推断、数据流分析和约束分析等主要静态分析方法及两种特别的分析方法,最后介绍了几种常用的静态代码安全检测工具。

Abstract

Static analysis can find security vulnerabilities by automatically deriving info rmation about the behavior of software. Comparing with other program analysis me thods, static analysis method can detect security vulnerabilities automatically and effectively. This paper introduces the fault pattern of security vulnerabili ty in Java language, and then presents the main static analysis methods and othe r two special methods. Lastly, some popular tools for detection of security vuln erability are listed. 

引用本文

导出引用
孙茜1;宫云战2杨朝红2,3. 基于静态检测的程序安全漏洞测试[J]. 北京化工大学学报(自然科学版), 2007, 34(s1): 9-12
SUN Qian1;GONG YunZhan2;YANG ZhaoHong2,3. JOURNAL OF BEIJING UNIVERSITY OF CHEMICAL TECHNOLOGY[J]. Journal of Beijing University of Chemical Technology, 2007, 34(s1): 9-12

参考文献

1]夏一民,罗军,张民选. 基于静态分析的安全漏洞检测技术研究[J]. 计 算机科学, 2006, 33: 279-282. 
[2]SHANKAR U, TALWAR K, FOSTER J S, et al. Detecting format string vulnerabi lities with type qualifiers[C]. USENIX Security Symposium, USA, 2001. 
[3]ZHANG Xiaolan, EDWARDS A. Using CQUAL for static analysis of authoriz ation hook[C]. USENIX Security Symposium, USA, 2002. 
[4]OHNSON R, WAGNER D. Finding user/kernel pointer bugs with type inference [C]. USENIX Security Symposium, 2004. 
[5]LAROCHELLE D. Statically detecting likely buffer overflow vulnerabili ties[C]. USENIX Security Symposium, USA, 2001. 
[6]XIE Yichen, CHOU A, ENGLER D. ARCHER: Using symbolic pathsensitive analys is to detect memory access errors[C]. ESEC/FSE'03, Helsinki, Finland, Septembe r, 2003. 
[7]DAS M, LEMER S, SEIGLE M. ESP: pathsensitive program verification in po lynomial time[C]. ACM PLDI, Germany, 2002. 
[8]AIKEN A. Introduction to set const raint 2 based program analysis[J]. S cience of Computer Programming, 1999, 35(2): 79-111. 
[9]WAGNER D, FOSTER J, BREWER E, et al. A first step towards automated detec tion of buffer overrun vulnerabilities[C]. Network and Distributed System Secu rity Symposium, USA, 2000. 〖ZK)〗
[10]ASHCRAFT K, ENGLER D. Using programmerwritten complier ext ensions to catch security holes[C]. IEEE Symposium on Security and Privacy, Oa kland, California, 2002. 
[11]YANG Junfeng, KREMENEK T, XIE Yichen, et al. Dawson Engler MECA: an extensible, expressive system and language for statically checking security prop erties[C]. In 10th ACM Conf on Computer and Communications Security, 2003.
PDF(440 KB)

5331

Accesses

0

Citation

Detail

段落导航
相关文章

/