Optimize value-flow analysis based static vulnerability detection by solver rating

Luohui Chen; Yong Tang; Min Zhou; Shuning Wei; Wenchuan Sun

doi:10.1117/12.2683173

26 June 2023 Optimize value-flow analysis based static vulnerability detection by solver rating

Luohui Chen, Yong Tang, Min Zhou, Shuning Wei, Wenchuan Sun

Proceedings Volume 12714, International Conference on Computer Network Security and Software Engineering (CNSSE 2023); 127140K (2023) https://doi.org/10.1117/12.2683173
Event: Third International Conference on Computer Network Security and Software Engineering (CNSSE 2023), 2023, Sanya, China

Abstract

Program static analysis is of great value of source code software vulnerability detection, but it is often limited by scalability bottlenecks. Constraint solvers are inefficient due to complex program dependencies on millions of lines of program source code. A single solver is difficult to get the balance between the accuracy and the time cost. This paper discusses the program dependence and constraint solving of static value-flow analysis, and specifically implements a solver rating system based on static taint analysis, which selects the most efficient solver for program dependence of critical path to reduce the false-positives and time cost of static vulnerability detection. Through testing for Juliet test sets and several real-world projects, we found that the overall performance of the system was better than other single SMT solvers or default scheduling strategies.

Citation Download Citation

Luohui Chen, Yong Tang, Min Zhou, Shuning Wei, and Wenchuan Sun "Optimize value-flow analysis based static vulnerability detection by solver rating", Proc. SPIE 12714, International Conference on Computer Network Security and Software Engineering (CNSSE 2023), 127140K (26 June 2023); https://doi.org/10.1117/12.2683173

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available