Security Vulnerabilities Detection Through Assertion-Based Approach

Organizations and companies develop very complex software today. Errors and flaws can be introduced at different phases of the software development life cycle and can lead to exploitable vulnerabilities. Furthermore, considering that most systems are exposed to multiple users and environments, such flaws can lead to attacks (or actions) with unpredictable consequences in terms of damage and costs. Most research that deals with security-related issues of software focuses their efforts on coding errors and flaws, regardless of the infrastructure and platforms that run the software applications. Often, such analyses of software applications vulnerabilities may lack sufficient specification details, thus possibly miss larger systematic flaws, and consequently obscure the existence of serious vulnerabilities. Our research aims at developing a technique capable of discovering the security weaknesses, specifically buffer overflow vulnerabilities in C/C++ programs, through the analysis of source code combined with architecture specifications. The proposed approach relies on the notion of platform assertions that is, a collection of logical relationships used to characterize a platform (execution environment). In this paper, we focus on such assertions and show how vulnerabilities analysis of software applications can be performed with our assertion-based approach. Furthermore, the generation of assertion specifications as well as the construction of an assertion library including various platforms are explored.