Study on Software Vulnerability Characteristics and Its Identification Method

Luo, Chen-Lan; Wang, Bo; Huang, Kun; Lou, Yunjiang

doi:10.1155/2020/1583132

Cited by 6 publications

(5 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For memory deallocation primitive, the mutation space of its parameter addr contains the addresses of all the allocated and deallocated chunks in the current state. For the writing primitive, the mutation space of its parameter addr contains the addresses to be controlled in the target state (the definition of target state will be given later), and the mutation space of width is the set [1,2,4,8,16,32,64,128]. en, we input these mutated MOPs into the heap allocator model one by one and process them according to the mapping relationship to obtain the final new program state.…”

Section: Heap Allocator Modelmentioning

confidence: 99%

“…Since cyberattacks have severely damaged the quality of software [1,2], considerable defensive schemes have been taken to protect software security [3,4]. In recent years, due to the deployment of mitigation mechanisms for stack-based vulnerabilities and compiler-level inspections, stack exploits have become increasingly more difficult to execute against hardened programs [5,6].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Pattern-Based Software Testing Framework for Exploitability Evaluation of Metadata Corruption Vulnerabilities

Deng

Wang

Zhang

et al. 2020

Scientific Programming

View full text Add to dashboard Cite

In recent years, increased attention is being given to software quality assurance and protection. With considerable verification and protection schemes proposed and deployed, today’s software unfortunately still fails to be protected from cyberattacks, especially in the presence of insecure organization of heap metadata. In this paper, we aim to explore whether heap metadata could be corrupted and exploited by cyberattackers, in an attempt to assess the exploitability of vulnerabilities and ensure software quality. To this end, we propose RELAY, a software testing framework to simulate human exploitation behavior for metadata corruption at the machine level. RELAY employs the heap layout serialization method to construct exploit patterns from human expertise and decomposes complex exploit-solving problems into a series of intermediate state-solving subproblems. With the heap layout procedural method, RELAY makes use of the fewer resources consumed to solve a layout problem according to the exploit pattern, activates the intermediate state, and generates the final exploit. Additionally, RELAY can be easily extended and can continuously assimilate human knowledge to enhance its ability for exploitability evaluation. Using 20 CTF&RHG programs, we then demonstrate that RELAY has the ability to evaluate the exploitability of metadata corruption vulnerabilities and works more efficiently compared with other state-of-the-art automated tools.

show abstract

Section: Heap Allocator Modelmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

A Pattern-Based Software Testing Framework for Exploitability Evaluation of Metadata Corruption Vulnerabilities

Deng

Wang

Zhang

et al. 2020

Scientific Programming

View full text Add to dashboard Cite

show abstract

“…While the former can constitute a potential loophole in information systems security [9], [10], faulty software development in utilizing the appropriate security requirements represents the core weakness in the landscape of information system security. According to Luo et al [11], such weaknesses are "defects in software's specific implementation or system security policy, which can enable attackers to access or damage the system without authorization".…”

Section: Introductionmentioning

confidence: 99%

Secure Software Development Awareness: A Case Study of Undergraduate Developers

Mutanga¹

2023

JREAS

View full text Add to dashboard Cite

As ubiquitous computing becomes an increasingly inherent component of everyday life due to the rapid growth of communication technologies and globalization, threats against information systems have taken a more latent yet lethal dimension. This emergent digital security challenge has correspondingly motivated a proactive change in the software engineering process in recent decades. This change has inspired more intense research scrutiny on security as a crucial component of any software system. Moreover, in today’s virtual world of hyperconnectivity, the most significant vulnerabilities in modern information systems security are software centred. Nevertheless, research shows that software developers often lack the required knowledge and skills in secure software systems development (SSD). Such knowledge ensures that all the resultant software components of each development lifecycle are correctly implemented rather than merely following the SSD lifecycle. Also, the knowledge engenders software security consciousness as a professional attitude amongst developers. Therefore, investigating students’ awareness of SSD principles can generate insight into evolving the undergraduate software development curriculum – a path to building future career developers. The study used a voluntary online survey to recruit a sample of 76 undergraduate developers and employed a descriptive approach to data analysis. Among other findings, the study revealed that participants' perception of the threat of software vulnerability impacts their attitude towards security on online and mobile platforms. And that though over 90% of the undergraduate developers took software vulnerability threats either “serious” or “extremely serious”, this disposition did not reflect the depth of their knowledge and experience in SSD.

show abstract

“…For example, in the context of this study, the work reported in [12] discussed students' software development knowledge at a more general level. However, current literature suggests that there has been more emphasis on improving students' programming skills and optimising teaching programming techniques [13][14][15]. But scanty investigations tend to probe students' awareness of emergent security challenges and the state-of-the-art software development principles designed to guarantee secure systems development.…”

Section: Introductionmentioning

confidence: 99%

Secure Software Development Awareness: A Case Study of Undergraduate Developers

Mutanga¹

2022

JES

View full text Add to dashboard Cite

As ubiquitous computing becomes an increasingly inherent component of everyday life due to the rapid growth of communication technologies and globalization, threats against information systems have taken a more latent yet lethal dimension. This emergent digital security challenge has correspondingly motivated a proactive change in the software engineering process in recent decades. This change has inspired more intense research scrutiny on security as a crucial component of any software system. Moreover, in today’s virtual world of hyperconnectivity, the most significant vulnerabilities in modern information systems security are software centred. Nevertheless, research shows that software developers often lack the required knowledge and skills in secure software systems development (SSD). Such knowledge ensures that all the resultant software components of each development lifecycle are correctly implemented rather than merely following the SSD lifecycle. Also, the knowledge engenders software security consciousness as a professional attitude amongst developers. Therefore, investigating students’ awareness of SSD principles can generate insight into evolving the undergraduate software development curriculum – a path to building future career developers. The study used a voluntary online survey to recruit a sample of 76 undergraduate developers and employed a descriptive approach to data analysis. Among other findings, the study revealed that participants’ perception of the threat of software vulnerability impacts their attitude towards security on online and mobile platforms. And that though over 90% of the undergraduate developers took software vulnerability threats either “serious” or “extremely serious”, this disposition did not reflect the depth of their knowledge and experience in SSD.

show abstract

Study on Software Vulnerability Characteristics and Its Identification Method

Cited by 6 publications

References 16 publications

A Pattern-Based Software Testing Framework for Exploitability Evaluation of Metadata Corruption Vulnerabilities

A Pattern-Based Software Testing Framework for Exploitability Evaluation of Metadata Corruption Vulnerabilities

Secure Software Development Awareness: A Case Study of Undergraduate Developers

Secure Software Development Awareness: A Case Study of Undergraduate Developers

Contact Info

Product

Resources

About