EXE: Automatically generating inputs of death

Proceedings of the ACM Conference on Computer and Communications Security

Volumn , Issue , 2006, Pages 322-335

  Cadar, Cristian ^a   Ganesh, Vijay ^a   Pawlowski, Peter M ^a   Dill, David L ^a   Engler, Dawson R ^a  

^a STANFORD UNIVERSITY   (United States)

Author keywords

Attack generation; Bug finding; Constraint solving; Dynamic analysis; Symbolic execution; Test case generation

Indexed keywords

CODES (SYMBOLS); COMPUTER OPERATING SYSTEMS; CONSTRAINT THEORY; DATA STORAGE EQUIPMENT; RANDOM PROCESSES; SERVERS; SUPERVISORY AND EXECUTIVE PROGRAMS;

ATTACK GENERATION; BUG FINDING; CONSTRAINT SOLVING; LINUX PACKET FILTERS; SYMBOLIC EXECUTION; TEST CASE GENERATION;

PROGRAM DEBUGGING;

EID: 34547241782     PISSN: 15437221     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1180405.1180445     Document Type: Conference Paper

References (47)

1. SMTLIB competition. http://www.csl.sri.com/users/demoura/smt-comp, August 2006.
2. T. Ball. A theory of predicate-complete test coverage and generation. In Proceedings of the Third International Symposium on Formal Methods for Components and Objects, Nov. 2004.
3. T. Ball and R. B. Jones, editors. Computer Aided Verification, 18th International Conference, CAV 2006, Seattle, WA, USA, August 17-20, 2006, Proceedings, volume 4144 of Lecture Notes in Computer Science. Springer, 2006.
4. T. Ball, R. Majumdar, T. Millstein, and S. K. Rajamani. Automatic predicate abstraction of C programs. In PLDI '01: Proceedings of the ACM SIGPLAN 2001 conference on Programming language design and implementation, pages 203-213. ACM Press, 2001.
5. T. Ball and S. Rajamani. Automatically validating temporal safety properties of interfaces. In SPIN 2001 Workshop on Model Checking of Software, May 2001.
6. C. Barrett and S. Berezin. CVC Lite: A new implementation of the cooperating validity checker. In R. Alur and D. A. Peled, editors, CAV, Lecture Notes in Computer Science. Springer, 2004.
7. C. Barrett, S. Berezin, I. Shikanian, M. Chechik, A. Gurfinkel, and D. L. Dill. A practical approach to partial functions in CVC Lite. In PDPAR'04 Workshop, Cork, Ireland, July 2004.
8. R. S. Boyer, B. Elspas, and K. N. Levitt. Select - a formal system for testing and debugging programs by symbolic execution. ACM SIGPLAN Notices, 10(6):234-45, June 1975.
9. G. Brat, K. Havelund, S. Park, and W. Visser. Model checking-programs. In IEEE International Conference on Automated Software Engineering (ASE), 2000.
10. D. Brumley, J. Newsome, D. Song, H. Wang, and S. Jha. Towards automatic generation of vulnerability-based signatures. In Proceedings of the 2006 IEEE Symposium on Security and Privacy, 2006.
11. R. E. Bryant, S. K. Lahiri, and S. A. Seshia. Modeling and verifying systems using a logic of counter arithmetic with lambda expressions and uninterpreted functions. In E. Brinksma and K. G. Larsen, editors, Proc. Computer-Aided Verification (CAV), pages 78-92. Springer-Verlaag, July 2002.
12. W. Bush, J. Pincus, and D. Sielaff. A static analyzer for finding dynamic programming errors. Software: Practice and Experience, 30(7):775-802, 2000.
13. C. Cadar and D. Engler. Execution generated test cases: How to make systems code crash itself. In Proceedings of the 12th International SPIN Workshop on Model Checking of Software, August 2005. A longer version of this paper appeared as Technical Report CSTR-2005-04, Computer Systems Laboratory, Stanford University.
14. E. Clarke and D. Kroening. Hardware verification using ANSI-C programs as a reference. In Proceedings of ASP-DAC 2003, pages 308-311. IEEE Computer Society Press, January 2003.
15. B. Cook, D. Kroening, and N. Sharygina. Cogent: Accurate theorem proving for program verification. In K. Etessami and S. K. Rajamani, editors, Proceedings of CAV 2005, volume 3576 of Lecture Notes in Computer Science, pages 296-300. Springer Verlag, 2005.
16. J. Corbett, M. Dwyer, J. Hatcliff, S. Laubach, C. Pasareanu, Robby, and H. Zheng. Bandera: Extracting finite-state models from Java source code. In ICSE 2000, 2000.
17. T. H. Cormen, C. E. Leiserson, R. L. Rivest, and C. Stein. Introduction to Algorithms. The MIT Electrical Engineering and Computer Science Series. MIT Press/McGraw Hill, 2001.
18. SWAT: the Coverity software analysis toolset. http ://coverity.com.
19. M. Das, S. Lerner, and M. Seigle. Path-sensitive program verification in polynomial time. In Proceedings of the ACM SIGPLAN 2002 Conference on Programming Language Design and Implementation, Berlin, Germany, June 2002.
20. R. DeLine and M. Fähndrich. Enforcing high-level protocols in low-level software. In Proceedings of the ACM SIGPLAN 2001 Conference on Programming Language Design and Implementation, June 2001.
21. N. Een and N. Sorensson. An extensible SAT-solver. In Proc. of the Sixth International Conference on Theory and Applications of Satisfiability Testing, pages 78-92, May 2003.
22. R. Ferguson and B. Korel. The chaining approach for software test data generation. ACM Trans. Softw. Eng. Methodol., 5(1):63-86, 1996.
23. C. Flanagan and S. N. Freund. Type-based race detection for Java. In SIGPLAN Conference on Programming Language Design and Implementation, pages 219-232, 2000.
24. C. Flanagan, K. Leino, M. Lillibridge, G. Nelson, J. Saxe, and R. Stata. Extended static checking for Java. In Proceedings of the ACM SIGPLAN 2002 Conference on Programming Language Design and Implementation. ACM Press, 2002.
25. J. Foster, T. Terauchi, and A. Aiken. Flow-sensitive type qualifiers. In Proceedings of the ACM SIGPLAN 2002 Conference on Programming Language Design and Implementation, June 2002.
26. P. Godefroid. Model Checking for Programming Languages using VeriSoft. In Proceedings of the 24th ACM Symposium on Principles of Programming Languages, 1997.
27. P. Godefroid, N. Klarlund, and K. Sen. DART: Directed automated random testing. In Proceedings of the Conference on Programming Language Design and Implementation (PLDI), Chicago, IL USA, June 2005. ACM Press.
28. A. Gotlieb, B. Botella, and M. Rueher. Automatic test data generation using constraint solving techniques. In ISSTA '98: Proceedings of the 1998 ACM SIGSOFT international symposium on Software testing and analysis, pages 53-62. ACM Press, 1998.
29. N. Gupta, A. P. Mathur, and M. L. Soffa. Automated test data generation using an iterative relaxation method. In SIGSOFT '98/FSE-6: Proceedings of the 6th ACM SIGSOFT International Symposium on Foundations of Software Engineering, pages 231-244. ACM Press, 1998.
30. R. Hastings and B. Joyce. Purify: Fast detection of memory leaks and access errors. In Proceedings of the Winter USENIX Conference, Dec. 1992.
31. G. J. Holzmann. The model checker SPIN. Software Engineering, 23(5):279-295, 1997.
32. G. J. Holzmann. From code to models. In Proc. 2nd Int. Conf. on Applications of Concurrency to System Design, pages 3-10, Newcastle upon Tyne, U.K., 2001.
33. S. Khurshid, C. S. Pasareanu, and W. Visser. Generalized symbolic execution for model checking and testing. In Proceedings of the Ninth International Conference on Tools and Algorithms for the Construction and Analysis of Systems, 2003.
34. E. Larson and T. Austin. High coverage detection of input-related security faults. In Proceedings of the 12th USENIX Security Symposium, August 2003.
35. B. P. Miller, L. Fredriksen, and B. So. An empirical study of the reliability of UNIX utilities. Communications of the Association for Computing Machinery, 33(12):32-44, 1990.
36. G. C. Necula, S. McPeak, S. Rahul, and W. Weimer. CIL: Intermediate language and tools for analysis and transformation of C programs. In International Conference on Compiler Construction, March 2002.
37. G. Nelson and D. Oppen. Simplification by cooperating decision procedures. ACM Transactions on Programming Languages and Systems, 1(2):245-57, 1979.
38. N. Nethercote and J. Seward. Valgrind: A program supervision framework. Electronic Notes in Theoretical Computer Science, 89(2), 2003.
39. PCRE - Perl Compatible Regular Expressions. http://www.pcre.org/.
40. PCRE Regular Expression Heap Overflow. US-CERT Cyber Security Bulletin SB05-334. http://www.us-cert.gov/cas/bulletins/SB05-334.html#pcre.
41. O. Ruwase and M. S. Lam. A practical dynamic buffer overflow detector. In Proceedings of the 11th Annual Network and Distributed System Security Symposium, pages 159-169, 2004.
42. K. Sen, D. Marinov, and G. Agha. CUTE: A concolic unit testing engine for C. In In 5th joint meeting of the European Software Engineering Conference and ACM SIGSOFT Symposium on the Foundations of Software Engineering (ESEC/FSE'05), Sept. 2005.
43. D. Wagner, J. Foster, E. Brewer, and A. Aiken. A first step towards automated detection of buffer overrun vulnerabilities. In The 2000 Network and Distributed Systems Security Conference. San Diego, CA, Feb. 2000.
44. Y. Xie and A. Aiken. Scalable error detection using boolean satisfiability. In Proceedings of the 32nd Annual Symposium on Principles of Programming Languages (POPL 2005), January 2005.
45. Y. Xie and A. Aiken. Saturn: A SAT-based tool for bug detection. In K. Etessami and S. K. Rajamani, editors, CAV, volume 3576 of Lecture Notes in Computer Science, pages 139-143. Springer, 2005.
46. J. Yang, C. Sar, P. Twohey, C. Cadar, and D. Engler. Automatically generating malicious disks using symbolic execution. In Proceedings of the 2006 IEEE Symposium on Security and Privacy, May 2006.
47. J. Yang, P. Twohey, D. Engler, and M. Musuvathi. Using model checking to find serious file system errors. In Symposium on Operating Systems Design and Implementation, December 2004.