Automatically assessing vulnerabilities discovered by compositional analysis

Abstract

Testing is the most widely employed method to find vulnerabilities in real-world software programs. Compositional analysis, based on symbolic execution, is an automated testing method to find vulnerabilities in medium-to large-scale programs consisting of many interacting components. However, existing compositional analysis frameworks do not assess the severity of reported vulnerabilities. In this paper, we present a framework to analyze vulnerabilities discovered by an existing compositional analysis tool and assign CVSS3 (Common Vulnerability Scoring System v3.0) scores to them, based on various heuristics such as interaction with related components, ease of reachability, complexity of design and likelihood of accepting unsanitized input. By analyzing vulnerabilities reported with CVSS3 scores in the past, we train simple machine learning models. By presenting our interactive framework to developers of popular open-source software and other security experts, we gather feedback on our trained models and further improve the features to increase the accuracy of our predictions. By providing qualitative (based on community feedback) and quantitative (based on prediction accuracy) evidence from 21 open-source programs, we show that our severity prediction framework can effectively assist developers with assessing vulnerabilities.

Combining Graph-Based Learning With Automated Data Collection for Code Vulnerability Detection

“…We apply FUNDED to five open-source projects that were also evaluated in prior studies [5,18,52,53]. Table V lists the software versions and the number of function-level vulnerabilities.…”

A Survey on Data-driven Software Vulnerability Assessment and Prioritization

“…Recently, several studies have started to predict CVSS version 3 exploitability metrics including the new Privileges and User Interactions. Ognawala et al [139] fed the features generated by a static analysis tool, Macke [140], to a Random forest model to predict these CVSS version 3 metrics for vulnerable software/components. Later, Chen et al [30] found that many SVs were disclosed on Twitter before on NVD.…”

“…Given the overlap, we hereby only describe the main directions and techniques of the Impact-related tasks rather than iterating the details of each study. Overall, a majority of the work has focused on classifying CVSS impact metrics (versions 2 and 3) using three main learning paradigms: single-task [30,50,86,108,139,193,200], multitarget [62,171] and multi-task [65] learning. Instead of developing a separate prediction model for each metric like the single-task approach, multi-target and multi-task approaches only need a single model for all tasks.…”

“…These three learning paradigms were powered by applying and/or customizing a wide range of data-driven methods. The first method was to use single ML classifiers like supervised Latent Dirichlet Allocation [200], Principal component analysis [180], Naïve Bayes [62,108,139], Logistic regression [86], Kernel-based SVM [193], Linear SVM [108], KNN [108] and Decision tree [171]. Other studies employed ensemble models combining the strength of multiple single models such as Random forest [108,139], boosting model [171] and XGBoost/LGBM [108].…”

Compositional Fuzzing Aided by Targeted Symbolic Execution

“…2. There may be many other factors [18], such as the degree of connectedness of a function [33] and the distance to an interface such as main function [35], that affect if a vulnerability may be exploited, even if an exploit from main could not be generated. 3.…”