Manual vulnerability discovery gets smarter, faster

Powered by SC Magazine

Automated vulnerability research falls short.

German university researchers have used machine learning to increase the efficiency of security vulnerabilities discovery in source code.

Modern techniques exist to speed-up detection of vulnerabilities, like fuzz testing, taint analysis and symbolic execution, but researchers Fabian Yamaguchi, Felix Lindner, and Konrad Rieck said the process was still tedious.

“The discovery of vulnerabilities in source code is a challenging and fascinating task – for blackhats as well as whitehats. Security bugs are often deeply buried within a code base and considerable expertise is required to bring these gems to the surface,” the researchers said.

“In recent years, several tools for automatically identifying vulnerabilities have been developed. However, these tools rather aim for spotting low-hanging fruit vulnerabilities and suffer from the inherent inability of one program to completely analyse another program's code.”

The method, dubbed vulnerability extrapolation, was an alternative to automated vulnerability detection that aimed to improve the more powerful manual inspection of source code.

It identified unknown vulnerabilities using programming patterns observed in known security flaws, since vulnerabilities were often linked to patterns of specific API usage.

“The method embeds code in a vector space, such that typical patterns of API usage can be determined automatically using machine learning techniques. These patterns implicitly capture semantics of the code and extrapolate from known vulnerabilities to identify potentially vulnerable code with similar characteristics.

This process of vulnerability extrapolation can suggest candidates for investigation to the analyst as well as ease the browsing of source code during auditing.”

Researchers demonstrated the method in two experiments: The first evaluated the ability of extrapolation to identify API usage patterns and to structure source code.

In the second experiment, the technique was applied to libraries produced by the ffmpeg project. Researchers narrowed a search for “interesting code” from 6778 to 20 functions, and discovered a known and zero-day vulnerability.

Researchers said the technique could capture many vulnerabilities by analysing API usage patterns but may miss others that would be identified by examining the code structure of a function.

They were investigating techniques for integrating structural information from source code into vulnerability extrapolation.

“The ability of our approach to narrow the auditing process to a few interesting functions may also play well with software testing, for example, for selectively fuzzing functions or performing involved symbolic execution,” they said.

The research paper is available online (pdf).

Copyright © SC Magazine, Australia

Manual vulnerability discovery gets smarter, faster
Top Stories
Toll Group to go Google
Poaches Woolworths project manager.
How News Corp's CIO tackled skills in his race to the cloud
What to do when your team’s talents are no longer needed.
Photos: How Thodey transformed Telstra
From turbulent Trujillo to Australia's leading telco.
Sign up to receive iTnews email bulletins
Latest Comments
Who do you trust most to protect your private data?

   |   View results
Your bank
Your insurance company
A technology company (Google, Facebook et al)
Your telco, ISP or utility
A retailer (Coles, Woolworths et al)
A Federal Government agency (ATO, Centrelink etc)
An Australian law enforcement agency (AFP, ASIO et al)
A State Government agency (Health dept, etc)

Do you support the abolition of the Office of the Information Commissioner?

   |   View results
I support shutting down the OAIC.
I DON'T support shutting the OAIC.