A distributed framework for demand-driven software vulnerability detection

• Published in: The Journal of systems and software 2014-01, Vol.87, p.60-73
• Main Authors: Zhang, Dazhi, Liu, Donggang, Csallner, Christoph, Kung, David, Lei, Yu
• Format: Article
• Language: English
• Subjects: Computer programs; Cybersecurity; Defects; End users; Flaw detection; Plugs; Security; Security testing; Signatures; Software; Software engineering; Software vulnerability; Studies; Test decomposition; Test systems; User behavior
• ISSN: 0164-1212; 1873-1228
• DOI: 10.1016/j.jss.2013.08.033

•We study how to take advantage of user-side data to improve security testing.•We monitor program execution and conduct testing if a new path is about to be explored.•We use test decomposition to mitigate the path explosion problem and reduce the cost of testing.•We use the bit sequence to encode the new path to protect user privacy and apply safe-mode execution to protect the security of program execution at the user side.•We found that testing decomposition significantly reduce the testing effort and the user-side cost. Security testing aims at detecting program security flaws through a set of test cases and has become an active area of research. The challenge is how to efficiently produce test cases that are highly effective in detecting security flaws. This paper presents a novel distributed demand-driven security testing system to address this challenge. It leverages how end users use the software to increase the coverage of essential paths for security testing. The proposed system consists of many client sites and one testing site. The software under test is installed at each client site. Whenever a new path is about to be exercised by a user input, it will be sent to the testing site for security testing. At the testing site, symbolic execution is used to check any potential vulnerability on this new path. If a vulnerability is detected, a signature is automatically generated and updated to all client sites for protection. The benefits are as follows. First, it allows us to focus testing on essential paths, i.e., the paths that are actually being explored by users or attackers. Second, it stops an attacker from exploiting an unreported vulnerability at the client site. A prototype system has been implemented to evaluate the performance of the proposed system. The results show that it is both effective and efficient in practice.