Detecting Violations of Security Requirements for Vulnerability Discovery in Source Code

Hongzhe LI, Jaesang OH, Heejo LEE
2016 IEICE transactions on information and systems  
Finding software vulnerabilities in source code before the program gets deployed is crucial to ensure the software quality. Existing source code auditing tools for vulnerability detection generate too many false positives, and only limited types of vulnerability can be detected automatically. In this paper, we propose an extendable mechanism to reveal vulnerabilities in source code with low false positives by specifying security requirements and detecting requirement violations of the potential
more » ... vulnerable sinks. The experimental results show that the proposed mechanism can detect vulnerabilities with zero false positives and indicate the extendability of the mechanism to cover more types of vulnerabilities. key words: software vulnerability, security sinks, security requirements
doi:10.1587/transinf.2016edl8035 fatcat:zr3m4ve4rbeqxlcigmx7d7m5b4