ReDeBug: Finding unpatched code clones in entire OS distributions

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2012, Pages 48-62

  Jang, Jiyong ^a   Agrawal, Abeer ^a   Brumley, David ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

debug; scalability; unpatched code clone

Indexed keywords

C++ (PROGRAMMING LANGUAGE); CODES (SYMBOLS); LINUX;

CODE CLONE; CODE CLONE DETECTION; CRITICAL PROBLEMS; DEBUG; DESIGN POINTS; DETECTION RATES; FALSE DETECTIONS; SECURITY-CRITICAL; SYNTAX-BASED APPROACH; UNPATCHED CODE CLONE;

CLONING;

EID: 84872099143     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2012.13     Document Type: Conference Paper

References (29)

1. Code Assurance. http://patterninsight.com/products/code-assurance/. Page checked 3/4/2012.
2. Pittsburgh Supercomputing Center. http://www.psc.edu/. Page checked 3/4/2012.
3. QuickLZ. http://www.quicklz.com/. Page checked 3/4/2012.
4. SimMetrics. http://sourceforge.net/projects/simmetrics/. Page checked 3/4/2012.
5. Ira D. Baxter, Christopher Pidgeon, and Michael Mehlich. DMS: program transformations for practical scalable software evolution. In Proceedings of the International Conference on Software Engineering, 2004.
6. Daniel Bernstein. http://www.cse.yorku.ca/∼oz/hash.html. Page checked 3/4/2012.
7. Al Bessey, Ken Block, Ben Chelf, Andy Chou, Bryan Fulton, Seth Hallem, Charles Henri-Gros, Asya Kamsky, Scott McPeak, and Dawson Engler. A few billion lines of code later: using static analysis to find bugs in the real world. Communications of the Association for Computing Machinery, 53(2):66-75, 2010.
8. Burton H. Bloom. Space/Time trade-offs in hash coding with allowable errors. Communications of the Association for Computing Machinery, 13(7):422-426, 1970.
9. Andrei Broder and Michael Mitzenmacher. Network applications of bloom filters: A survey. Internet Mathematics, 1(4):485-509, 2005.
10. David Brumley, Pongsin Poosankam, Dawn Song, and Jiang Zheng. Automatic patch-based exploit generation is possible: Techniques and implications. In Proceedings of the IEEE Symposium on Security and Privacy, May 2008.
11. Christophe Calvès and Maribel Fernández. A polynomial nominal unification algorithm. Theoretical Computer Science, 403:285-306, 2008.
12. Ben Collins-Sussman, Brian W. Fitzpatrick, and C. Michael Pilato. Version control with subversion. http://svnbook.red-bean.com/en/1.0/svn-book.html#svn- ch-3-sect-4.3.2. Page checked 3/4/2012.
13. National Vulnerability Database. CVE-2008-0928. http://web.nvd.nist.gov/ view/vuln/detail?vulnId=CVE-2008-0928. Page checked 3/4/2012.
14. National Vulnerability Database. CVE-2009-3720. http://web.nvd.nist.gov/ view/vuln/detail?vulnId=CVE-2009-3720. Page checked 3/4/2012.
15. National Vulnerability Database. CVE-2010-0405. http://web.nvd.nist.gov/ view/vuln/detail?vulnId=CVE-2010-0405. Page checked 3/4/2012.
16. National Vulnerability Database. CVE-2011-1092. http://web.nvd.nist.gov/ view/vuln/detail?vulnId=CVE-2011-1092. Page checked 3/4/2012.
17. National Vulnerability Database. CVE-2011-1782. http://web.nvd.nist.gov/ view/vuln/detail?vulnId=CVE-2011-1782. Page checked 3/4/2012.
18. National Vulnerability Database. CVE-2011-3200. http://web.nvd.nist.gov/ view/vuln/detail?vulnId=CVE-2011-3200. Page checked 3/4/2012.
19. National Vulnerability Database. CVE-2011-3368. http://web.nvd.nist.gov/ view/vuln/detail?vulnId=CVE-2011-3368. Page checked 3/4/2012.
20. National Vulnerability Database. CVE-2011-3872. http://web.nvd.nist.gov/ view/vuln/detail?vulnId=CVE-2011-3872. Page checked 3/4/2012.
21. Mark Gabel, Junfeng Yang, Yuan Yu, Moises Goldszmidt, and Zhendong Su. Scalable and systematic detection of buggy inconsistencies in source code. In Proceedings of the ACM International Conference on Object Oriented Programming Systems Languages and Applications, 2010.
22. Jiyong Jang, David Brumley, and Shobha Venkataraman. BitShred: feature hashing malware for scalable triage and semantic analysis. In Proceedings of the ACM Conference on Computer and Communications Security, 2011.
23. Lingxiao Jiang, Ghassan Misherghi, and Zhendong Su. Deckard: Scalable and accurate tree-based detection of code clones. In Proceedings of the International Conference on Software Engineering, 2007.
24. Toshihiro Kamiya, Shinji Kusumoto, and Katsuro Inoue. CCFinder: a multilinguistic token-based code clone detection system for large scale source code. IEEE Transactions on Software Engineering, 28(7):654-670, 2002.
25. Zhenmin Li, Shan Lu, Suvda Myagmar, and Yuanyuan Zhou. CP-Miner: finding copy-paste and related bugs in large-scale software code. IEEE Transactions on Software Engineering, 32:176-192, 2006.
26. Na Meng, Miryung Kim, and Kathryn S. McKinley. Systematic editing: generating program transformations from an example. In Proceedings of the ACM SIGPLAN conference on Programming Language Design and Implementation, 2011.
27. Ubuntu Security Notice. CVE-2011-3145. http://www.ubuntu.com/usn/usn- 1196-1/. Page checked 3/4/2012.
28. Saul Schleimer, Daniel Wilkerson, and Alex Aiken. Winnowing: Local algorithms for document fingerprinting. In Proceedings of the ACM SIGMOD/PODS Conference, 2003.
29. Qinfeng Shi, James Petterson, Gideon Dror, John Langford, Alex Smola, and S.V.N. Vishwanathan. Hash kernels for structured data. Journal of Machine Learning Research, 10:2615-2637, 2009.