Detection of Software Vulnerability by Using Fault Pattern and Program Slicing
Jiang Fan · Information Security and Communications Privacy · 2009
The method for detecting software vulnerability by using fault pattern and program slicing is proposed. The fault pattern database includes the historic fault patterns of software and some common fault patterns. Then the input parameters of function are defined as the pre-condition and the fault patterns as the post-condition. The program slicing based on specification,which matches the pre-condition and the post-condition,is computed,and then a doubtful path is gained,which may contains vulnerability. When a set of doubtful paths is obtained,the symbolic execution and constraint solver is used to certificate them and automatically generate the test case which would trigger the bug. This method could locate the area of vulnerability quickly,and automatically generate the input which would trigger the bug.