Static analysis with demand-driven value refinement

Stein, Benno; Nielsen, Benjamin Barslev; Chang, Bor-Yuh Evan; Möller, Anders

doi:10.1145/3360566

Cited by 17 publications

(11 citation statements)

References 42 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Package-level detection is not accurate and could introduce false positives [56]. Although it is a difficult task [63,67,73], reachability analysis based on call graph [68] can precisely filter out if these vulnerable codes are really called.…”

Section: Discussion 61 Lessons Learned By Our Studymentioning

confidence: 99%

Demystifying the Vulnerability Propagation and Its Evolution via Dependency Trees in the NPM Ecosystem

Li¹,

Chen²,

Li³

et al. 2022

Preprint

View full text Add to dashboard Cite

Third-party libraries with rich functionalities facilitate the fast development of JavaScript software, leading to the explosive growth of the NPM ecosystem. However, it also brings new security threats that vulnerabilities could be introduced through dependencies from third-party libraries. In particular, the threats could be excessively amplified by transitive dependencies. Existing research only considers direct dependencies or reasoning transitive dependencies based on reachability analysis, which neglects the NPM-specific dependency resolution rules as adapted during real installation, resulting in wrongly resolved dependencies. Consequently, further fine-grained analysis, such as precise vulnerability propagation and their evolution over time in dependencies, cannot be carried out precisely at a large scale, as well as deriving ecosystem-wide solutions for vulnerabilities in dependencies.To fill this gap, we propose a knowledge graph-based dependency resolution, which resolves the inner dependency relations of dependencies as trees (i.e., dependency trees), and investigates the security threats from vulnerabilities in dependency trees at a large scale. Specifically, we first construct a complete dependencyvulnerability knowledge graph (DVGraph) that captures the whole NPM ecosystem (over 10 million library versions and 60 million well-resolved dependency relations). Based on it, we propose a novel algorithm (DTResolver) to statically and precisely resolve dependency trees, as well as transitive vulnerability propagation paths, for each package by taking the official dependency resolution rules into account. Based on that, we carry out an ecosystem-wide empirical study on vulnerability propagation and its evolution in

show abstract

Section: Discussion 61 Lessons Learned By Our Studymentioning

confidence: 99%

Demystifying the Vulnerability Propagation and Its Evolution via Dependency Trees in the NPM Ecosystem

Li¹,

Chen²,

Li³

et al. 2022

Preprint

View full text Add to dashboard Cite

show abstract

“…Value partitioning [Nielsen and Mùller 2020], is an efficient trace partitioning [Rival and Mauborgne 2007] variant, where the analysis does not attempt to refine abstract states, but instead, abstract values. This apporach manages to circumvent the expensive abstract state partitioning [Ko et al 2017] or additional backwards analysis [Stein et al 2019] that previous apporaches required, while maintaining precision.…”

Section: Related Workmentioning

confidence: 99%

Symbolic value-flow static analysis: deep, precise, complete modeling of Ethereum smart contracts

Smaragdakis

Grech

Lagouvardos

et al. 2021

Proc. ACM Program. Lang.

View full text Add to dashboard Cite

We present a static analysis approach that combines concrete values and symbolic expressions. This symbolic value-flow (“symvalic”) analysis models program behavior with high precision, e.g., full path sensitivity. To achieve deep modeling of program semantics, the analysis relies on a symbiotic relationship between a traditional static analysis fixpoint computation and a symbolic solver: the solver does not merely receive a complex “path condition” to solve, but is instead invoked repeatedly (often tens or hundreds of thousands of times), in close cooperation with the flow computation of the analysis. The result of the symvalic analysis architecture is a static modeling of program behavior that is much more complete than symbolic execution, much more precise than conventional static analysis, and domain-agnostic: no special-purpose definition of anti-patterns is necessary in order to compute violations of safety conditions with high precision. We apply the analysis to the domain of Ethereum smart contracts. This domain represents a fundamental challenge for program analysis approaches: despite numerous publications, research work has not been effective at uncovering vulnerabilities of high real-world value. In systematic comparison of symvalic analysis with past tools, we find significantly increased completeness (shown as 83-96% statement coverage and more true error reports) combined with much higher precision, as measured by rate of true positive reports. In terms of real-world impact, since the beginning of 2021, the analysis has resulted in the discovery and disclosure of several critical vulnerabilities, over funds in the many millions of dollars. Six separate bug bounties totaling over $350K have been awarded for these disclosures.

show abstract

“…A potential limitation is that it can be hard to pre-compute a proper call graph for certain dynamic languages such as JavaScript [19,34,43,60]. To support such languages, future work can extend Chianina to explore call edges on-the-fly as part of the computation model.…”

Section: Chianina Overviewmentioning

confidence: 99%

Chianina: an evolving graph system for flow- and context-sensitive analyses of million lines of C code

Zuo

Zhang

Pan

et al. 2021

Proceedings of the 42nd ACM SIGPLAN International Conference on Programming Language Design and Implementation

View full text Add to dashboard Cite

Static analysis with demand-driven value refinement

Cited by 17 publications

References 42 publications

Demystifying the Vulnerability Propagation and Its Evolution via Dependency Trees in the NPM Ecosystem

Demystifying the Vulnerability Propagation and Its Evolution via Dependency Trees in the NPM Ecosystem

Symbolic value-flow static analysis: deep, precise, complete modeling of Ethereum smart contracts

Chianina: an evolving graph system for flow- and context-sensitive analyses of million lines of C code

Contact Info

Product

Resources

About