AutoISES: Automatically inferring security specifications and detecting violations

Proceedings of the 17th USENIX Security Symposium

Volumn , Issue , 2008, Pages 379-394

  Tan, Lin ^a   Zhang, Xiaolan ^b   Ma, Xiao ^a,c   Xiong, Weiwei ^a   Zhou, Yuanyuan ^a,c  

^a UNIVERSITY OF ILLINOIS AT URBANA CHAMPAIGN   (United States)

^b IBM T J WATSON RESEARCH CENTER   (United States)

^c Pattern Insight Inc   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER PROGRAMMING; LINUX; SPECIFICATIONS;

APPLIED PROGRAMS; AUTOMATICALLY GENERATED; PRODUCTION SOFTWARE; SECURITY PROPERTIES; SECURITY VIOLATIONS; SECURITY VULNERABILITIES; SOFTWARE SECURITY; SOURCE CODES;

SECURITY OF DATA;

EID: 84894034704     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (30)

1. Vulnerability summary CVE-2006-1856. http://nvd.nist.gov/nvd.cfm?cvename=CVE-2006-1856.
2. A. Aiken, S. Bugrara, I. Dillig, T. Dillig, B. Hackett, and P. Hawkins. An overview of the Saturn project. In Proceedings of the 7th ACM SIGPLAN-SIGSOFT workshop on program analysis for software tools and engineering, 2007.
3. G. Ammons, R. Bodik, and J. R. Larus. Mining specifications. In Symposium on Principles of Programming Languages, 2002.
4. T. Ball and S. Rajamani. The SLAM project: Debugging system software via static analysis. In Proceedings of the 29th ACM Symposium on Principles of Programming Languages, 2002.
5. D. Beyer, A. J. Chlipala, T. A. Henzinger, R. Jhala, and R. Majumdar. The BLAST query language for software verification. In Proceedings of the 11th International Static Analysis Symposium, 2004.
6. H. Chen and D. Wagner. MOPS: An infrastructure for examining security properties of software. In Proceedings of the 9th ACM Conference on Computer and Communications Security, 2002.
7. G. S. Coker. Xen security modules: Intro. http://lists.xensource.com/archives/html/xensedevel/2006-09/msg00000.html.
8. J. C. Corbett, M. B. Dwyer, J. Hatcliff, S. Laubach, C. S. Pãsãreanu, Robby, and H. Zheng. Bandera: Extracting Finite-State Models from Java Source Code. In Proceedings of the 22nd International Conference on Software Engineering, 2000.
9. A. Edwards, T. Jaeger, and X. Zhang. Runtime verification of authorization hook placement for the linux security modules framework. In Proceedings of the 9th ACM Conference on Computer and Communications Security, 2002.
10. D. R. Engler, D. Y. Chen, S. Hallem, A. Chou, and B. Chelf. Bugs as deviant behavior: A general approach to inferring errors in systems code. In Proceedings of the 18th ACM Symposium on Operating Systems Principles, 2001.
11. M. D. Ernst, A. Czeisler, W. G. Griswold, and D. Notkin. Quickly detecting relevant program invariants. In Proceedings of the 22nd International Conference on Software Engineering, 2000.
12. J. Foster, M. Fahndrich, and A. Aiken. A theory of type qualifiers. In ACM SIGPLAN Conference on Programming Language Design and Implementation, 1999.
13. V. Ganapathy, T. Jaeger, and S. Jha. Retrofitting legacy code for authorization policy enforcement. In Proceedings of the 2006 IEEE Symposium on Security and Privacy, 2006.
14. V. Ganapathy, S. Jha, D. Chandler, D. Melski, and D. Vitek. Buffer overrun detection using linear programming and static analysis. In Proceedings of the 10th ACM Conference on Computer and Communications Security, 2003.
15. V. Ganapathy, D. King, T. Jaeger, and S. Jha. Mining security-sensitive operations in legacy code using concept analysis. In Proceedings of the 29th International Conference on Software Engineering, 2007.
16. S. Hallem, B. Chelf, Y. Xie, and D. Engler. A system and language for building system-specific static analyses. In ACM SIGPLAN Conference on Programming Language Design and Implementation, 2002.
17. G. J. Holzmann and M. H. Smith. Software model checking: Extracting verification models from source code. Software Testing, Verification and Reliability, 2001.
18. T. Jaeger, A. Edwards, and X. Zhang. Consistency analysis of authorization hook placement in the linux security modules framework. ACM Transactions on Information and System Security, 2004.
19. W. Lee, S. J. Stolfo, and K. W. Mok. Adaptive intrusion detection: A data mining approach. Artificial Intelligence Review, 2000.
20. Z. Li and Y. Zhou. PR-Miner: Automatically extracting implicit programming rules and detecting violations in large software code. In 13th ACM SIGSOFT Symposium on the Foundations of Software Engineering, 2005.
21. D. Lie, A. Chou, D. Engler, and D. L. Dill. A simple method for extracting models from protocol code. In Proceedings of the 28th Annual International Symposium on Computer Architecture, 2001.
22. S. Lu, S. Park, C. Hu, X. Ma, W. Jiang, Z. Li, R. A. Popa, and Y. Zhou. MUVI: Automatically inferring multi-variable access correlations and detecting related semantic and concurrency bugs. In Proceedings of the 21st ACM Symposium on Operating Systems Principles, 2007.
23. NSA. Security-Enhanced Linux (SELinux). Available at http://www.nsa.gov/selinux.
24. S. Shoham, E. Yahav, S. Fink, and M. Pistoia. Static specification mining using automata-based abstractions. In Proceedings of the International Symposium on Software Testing and Analysis (ISSTA’07), pages 174–184.
25. K. Thompson. Reflections on Trusting Trust. Communications of the ACM, 1995.
26. A. Tongaonkar, N. Inamdar, and R. Sekar. Inferring higher level policies from firewall rules. In Proceedings of the 21st Large Installation System Administration Conference, 2007.
27. D. Wagner, J. S. Foster, E. A. Brewer, and A. Aiken. A first step towards automated detection of buffer overrun vulnerabilities. In Proceedings of the 2000 Network and Distributed Systems Security Conference, 2000.
28. C. Wright, C. Cowan, J. Morris, S. Smalley, and G. Kroah-Hartman. Linux security modules: General security support for the linux kernel. In Proceedings of the 11th USENIX Security Symposium, 2002.
29. C. Wysopal and C. Eng. Static detection of application backdoors. Available at http://www.veracode.com/images/stories/staticdetection-of-backdoors-1.0.pdf.
30. X. Zhang, A. Edwards, and T. Jaeger. Using cqual for static analysis of authorization hook placement. In Proceedings of the 11th USENIX Security Symposium, 2002.