Non-Distinguishable Inconsistencies as a Deterministic Oracle for Detecting Security Bugs
Qingyang Zhou, Qiushi Wu, Dinghao Liu, Shouling Ji, Kangjie Lu · Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security · 2022
Security bugs like memory errors are constantly introduced to software programs, and recent years have witnessed an increasing number of reported security bugs. Traditional detection approaches are mainly specification-based---detecting violations against a specified rule as security bugs. This often does not work well in practice because specifications are difficult to specify and generalize, leaving complicated and new types of bugs undetected. Recent research thus leans toward deviation-based detection which finds a substantial number of similar cases and detects deviating cases as potential bugs. This, however, suffers from two other problems. First, it requires enough similar cases to find deviations and thus cannot work for custom code that does not have similar cases. Second, code-similarity analysis is probabilistic and challenging, so the detection can be unreliable. Sometimes, similar cases can normally have deviating behaviors under different contexts.