Detection of security vulnerabilities in C language applications. Issue 1 (19th December 2017)

• Record Type: Journal Article
• Authors: Boudjema, El Habib; Faure, Christèle; Sassolas, Mathieu; Mokdad, Lynda
• Is Part Of: Security and privacy. Volume 1:Issue 1(2018)
• Page Start: n/a
• Page End: n/a
• Publication Date: 2017-12-19
• Subjects: C language library -- detection -- security -- static analysis -- vulnerability; Computer security -- Periodicals; Data protection -- Periodicals; Cyberterrorism -- Periodicals; 005.8
• DOI: 10.1002/spy2.8
• Languages: English
• ISSNs: 2475-6725

Abstract

Abstract : Security of computer systems is central in our digitalized world. Security of businesses, persons, and even governments is facing a growing threat from a wide variety of attackers. Eliminating vulnerabilities from application's code is necessary to prevent attacks. The first step toward eliminating security vulnerabilities is their detection, which can be an arduous task in large size programs. Static analysis of the code helps to automate this process, by guiding the programmer toward the potential vulnerabilities before they are discovered by an adversary. We investigate in this paper vulnerabilities that arise in C code through the calling of library functions. We define criteria to detect dangerous use of these functions, and show that the evaluation of a static analyzer implementing the proposed detection model yields a low false‐positive rate.