Improving Accuracy and Completeness of Source Code Static Taint Analysis

Shimchik, N. V.; Ignatyev, Valery; Belevantsev, Andrey

doi:10.1109/ispras53967.2021.00014

Cited by 4 publications

(2 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Близким аналогом к нему является реализация USE-AFTER-FREE детектора в SVACE [5]. Также существует подход на основе анализа помеченных данных, например, IRBIS [12], преимуществом которого является возможность обнаруживать больше ошибок, ценой значительной доли ложных предупреждений. Оба инструмента поддерживают языки программирования C и C++.…”

Section: существующие решенияunclassified

Detection of uses of disposed resources in C\# source code using static analysis

Tsiazhkorob¹,

Ignatyev²,

Belevantsev³

2022

Proceedings of ISP RAS

View full text Add to dashboard Cite

The paper is devoted to the scalable approach for the detection of uses of disposed resources in C# source code, that is based on static symbolic execution. The resulting detector is implemented as a part of an industrial SharpChecker, that performs a scalable inter-procedural path-, and context-sensitive analysis. The evaluation of the developed detector shows 70% true positive ratio allowing it to include to the standard set of detectors and provide functionality to users. The paper describes a detection algorithm that takes into account the limitations imposed by the existing infrastructure of SharpChecker, its evaluation on the set of open-source programs containing 6 mln LOC and some examples of found errors in real projects.

show abstract

Section: существующие решенияunclassified

Detection of uses of disposed resources in C\# source code using static analysis

Tsiazhkorob¹,

Ignatyev²,

Belevantsev³

2022

Proceedings of ISP RAS

View full text Add to dashboard Cite

show abstract

“…Кроме того, для анализа языков C и C++ дополнительно необходима реализация анализа псевдонимов. Детали реализации статического анализа помеченных данных в нашем инструменте подробно изложены в статьях [25,26]. Для исключения срабатываний, пропущенных другими анализаторами, реализован алгоритм анализа виртуальных вызовов и вызовов по указателю, позволяющий не терять помеченность при таких вызовах, эвристический алгоритм обнаружения истоков, позволяющий исследовать, например, библиотеки, для которых истоки и стоки находится в разных компонентах связности графа вызовов, алгоритмы моделирования окруженияфункций без исходного кода.…”

Section: статический анализ помеченных данныхunclassified

Irbis: static taint analyzer for vulnerabilities detection in C/C++

Shimchik¹,

Ignatyev²,

Belevantsev³

2022

Proceedings of ISP RAS

View full text Add to dashboard Cite

Static taint analysis can be used to find various security weaknesses and vulnerabilities in programs by discovering dataflow paths from taint sources to taint sinks. In most cases the data is called ”tainted” if it was obtained from an untrusted source without proper sanitization. In this paper we present a static taint analyzer Irbis. It implements analysis based on IFDS (Interprocedural Finite Distributive Subset) dataflow problem, as well as various extensions aimed at improving accuracy and completeness of the analysis. It supports different definitions of tainted data, which enables it to find such weaknesses as out of buffer access, use of freed memory, hardcoded passwords, data leaks and discover dataflow paths between user-defined sources and sinks. All sources, sinks and propagators definitions are stored in JSON format and can be adjusted to meet the users’ needs. We compare analysis results on Juliet Test Suite for C/C++ with several other analyzers, such as Infer, Clang Static Analyzer and Svace. Irbis manages to demonstrate 100% coverage on taint-related subset of tests for implemented CWEs, while suppressing all the false positives using heuristics. We also show performance and false positive rate on real projects, with examples of real vulnerabilities, which can be detected by Irbis.

show abstract