Manual vulnerability discovery gets smarter, faster

Powered by SC Magazine

Automated vulnerability research falls short.

German university researchers have used machine learning to increase the efficiency of security vulnerabilities discovery in source code.

Modern techniques exist to speed-up detection of vulnerabilities, like fuzz testing, taint analysis and symbolic execution, but researchers Fabian Yamaguchi, Felix Lindner, and Konrad Rieck said the process was still tedious.

“The discovery of vulnerabilities in source code is a challenging and fascinating task – for blackhats as well as whitehats. Security bugs are often deeply buried within a code base and considerable expertise is required to bring these gems to the surface,” the researchers said.

“In recent years, several tools for automatically identifying vulnerabilities have been developed. However, these tools rather aim for spotting low-hanging fruit vulnerabilities and suffer from the inherent inability of one program to completely analyse another program's code.”

The method, dubbed vulnerability extrapolation, was an alternative to automated vulnerability detection that aimed to improve the more powerful manual inspection of source code.

It identified unknown vulnerabilities using programming patterns observed in known security flaws, since vulnerabilities were often linked to patterns of specific API usage.

“The method embeds code in a vector space, such that typical patterns of API usage can be determined automatically using machine learning techniques. These patterns implicitly capture semantics of the code and extrapolate from known vulnerabilities to identify potentially vulnerable code with similar characteristics.

This process of vulnerability extrapolation can suggest candidates for investigation to the analyst as well as ease the browsing of source code during auditing.”

Researchers demonstrated the method in two experiments: The first evaluated the ability of extrapolation to identify API usage patterns and to structure source code.

In the second experiment, the technique was applied to libraries produced by the ffmpeg project. Researchers narrowed a search for “interesting code” from 6778 to 20 functions, and discovered a known and zero-day vulnerability.

Researchers said the technique could capture many vulnerabilities by analysing API usage patterns but may miss others that would be identified by examining the code structure of a function.

They were investigating techniques for integrating structural information from source code into vulnerability extrapolation.

“The ability of our approach to narrow the auditing process to a few interesting functions may also play well with software testing, for example, for selectively fuzzing functions or performing involved symbolic execution,” they said.

The research paper is available online (pdf).

Copyright © SC Magazine, Australia

Manual vulnerability discovery gets smarter, faster
Top Stories
ANZ looks to life beyond the transaction
If digital disruptors think an online payments startup could rock the big four, they’ve missed the point of why people use banks, says Patrick Maes.
What InfoSec can learn from the insurance industry
[Blog post] Another way data breach laws could help manage risk.
A ten-point plan for disrupting security
[Blog post] How can you defend the perimeter when it’s in the cloud?
Sign up to receive iTnews email bulletins
Latest Comments
What is delaying adoption of public cloud in your organisation?

   |   View results
Lock-in concerns
Application integration concerns
Security and compliance concerns
Unreliable network infrastructure
Data sovereignty concerns
Lack of stakeholder support
Protecting on-premise IT jobs
Difficulty transitioning CapEx budget into OpEx