Modeling and Discovering Vulnerabilities with Code Property Graphs

Abstract

Abstract-The vast majority of security breaches encountered today are a direct result of insecure code. Consequently, the protection of computer systems critically depends on the rigorous identification of vulnerabilities in software, a tedious and errorprone process requiring significant expertise. Unfortunately, a single flaw suffices to undermine the security of a system and thus the sheer amount of code to audit plays into the attacker's cards. In this paper, we present a method to effectively mine large amounts of source code for vulnerabilities. To this end, we introduce a novel representation of source code called a code property graph that merges concepts of classic program analysis, namely abstract syntax trees, control flow graphs and program dependence graphs, into a joint data structure. This comprehensive representation enables us to elegantly model templates for common vulnerabilities with graph traversals that, for instance, can identify buffer overflows, integer overflows, format string vulnerabilities, or memory disclosures. We implement our approach using a popular graph database and demonstrate its efficacy by identifying 18 previously unknown vulnerabilities in the source code of the Linux kernel.

Reverse Engineering State and Strategy Design Patterns using Static Code Analysis

“…Fabian et al [32] combines three representations into a unified data structure. In [32], author introduced a new concept of Code Property Graph which models ASTs, CFGs and PDGs as property graphs.…”

Big Code: New Opportunities for Improving Software Construction

“…In particular, the Joern tool represents programs as code property graphs, a combination of abstract syntax trees (AST), control flow graphs (CFG) and program dependency graphs (PDG), and stores them in a graph database [5]. That representation allows modeling templates of common vulnerabilities with graph traversals to identify buffer and integer overflows, format string vulnerabilities, and memory disclosures.…”

Security slicing for auditing XML, XPath, and SQL injection vulnerabilities

“…Yamaguchi et al [22], [52] also proposed methods that assist security auditing for C/C ++ programs by using machine learning to classify functions as vulnerable/non-vulnerable based on the absence/presence of sanitization [52], or by applying intraprocedural analysis on the code property graph (a combination of AST, CFG and PDG) of a program [22]. Besides the fact that we focus on Java instead of C/C ++ , our approach is based on interprocedural analysis which takes the call-return and parameter-passing mechanisms of the program into account.…”

“…Symbolic execution-based security analysis approaches have yet to address scalability issues due to the path explosion problem [21]. Other approaches [22] report analysis results without any form of pruning (e.g. the whole program dependency graphs), thus containing a significant amount of information not useful to security auditing.…”