Security testing has gained significant attention recently due to frequent attacks against software systems. This paper presents a trace-based security testing approach. It reuses test cases generated from previous testing methods to pro duce execution traces. An execution trace is a sequence of program statements exercised by a test case. Each trace is symbolically executed to produce program constraints and security constraints. A program constraint is a constraint imposed by program logic on program variables. A se curity constraint is a condition on program variables that must be satisfied to ensure system security. A security flaw exists if there is an assignment of values to program vari ables that satisfies the program constraint but violates the security constraint. This approach detects security flaws even if existing test cases do not trigger them. The nov elty of this method is a test model that unifies program con straints and security constraints such that formal reason ing can be applied to detect vulnerabilities. A tool named SecTAC is implemented and applied to J 4 benchmark pro grams and 3 open-source programs. The experiment shows that SecTAC quickly detects all reported vulnerabilities and J 3 new ones that have not been detected before. Introduction Software security has gained significant attention in re cent years due to the huge number of security attacks that exploit vulnerabilities in software. Security testing is be coming an active area of research, aiming at identifying software vulnerabilities effectively. Recently, many ap proaches have been proposed to detect vulnerabilities in programs [25, 14, 11, 5, 22, 1, 20, 6, 23, 4, 10, 12, 26] . Static analysis has been used to scan source code for er rors that crash a system or cause security problems [24, 25] . These static analysis tools use heuristics to determine if a security problem could occur; they usually approximate or even ignore runtime dynamics such as branch conditions and how buffer elements are visited. Thus, they are often imprecise, causing many false alarms. Dynamic analysis examines program execution to detect security problems [13, 8, 9, 1, 20, 23] . These tools feed test data to a program and monitor its runtime behavior. A 978-1-4244-7501-8/10/$26 .00 ©201O IEEE security vulnerability is detected if the behavior is consid ered abnormal, e.g., the program accessed a buffer outside its bounds. Although dynamic analysis reduces false alarm rates, it requires test inputs that actually cause security prob lems. This places a huge burden on testers. Dynamic symbolic execution, also called concolic test ing, is often used in automatic test data generation for find ing errors that crash a system or cause security problems [11, 22, 21, 6, 4, 10, 12, 26] . These tools perform concrete and symbolic execution of a program simultaneously to ex plore as many paths as possible. They do not need inputs that can actually cause security problems. However, they are either ineffective in the sense that unguided path explo ration may not cover important vulnerabilities, or do not scale well to large and complex programs. In this paper, we propose a novel security testing ap proach using trace-based symbolic execution and satisfia bility analysis. Trace-based symbolic execution avoids the search space explosion of conventional symbolic execution. In our approach, each existing test case is used to generate an execution trace, i.e., the sequence of exercised program statements. Symbolic execution is then applied to produce two kinds of predicates. The first predicate is called a pro gram constraint (PC), which specifies a condition that pro gram variables must satisfy after the execution of the state ment. The second predicate is called a security constraint (SC), which specifies the condition that program variables must satisfy to ensure the security of the given program ex ecution. A security vulnerability is detected if there is an assignment of values to program variables satisfies PC but violates SC, i.e., PC 1\--, SC is satisfiable. The advantages of our approach are as follows. First, As opposed to previous approaches, we can guide our search to focus on those features of the user program that are most important to the user-as indicated by the developers' will ingness to write test cases for them. Our approach can de tect security flaws even if these existing test cases do not trigger them. In other words, our technique can generate new inputs that trigger security problems, even if the user supplied inputs do not. Second, we propose a test model that unifies program constraints and security constraints us ing logical expressions so that formal reasoning can be per formed to detect security vulnerabilities. Hence, our ap- DSN 2010: Zhang et al.
Symbolic execution has been proposed to do program path verification but it cannot resolve complex programs with enormous amount of path constraints REF .
Detecting vulnerabilities in C programs using trace-based testing
2010 IEEE/IFIP International Conference on Dependable Systems & Networks (DSN)
2010 IEEE/IFIP International Conference on Dependable Systems & Networks (DSN)
Computer Science