Boosting static analysis accuracy with instrumented test executions

Recent research proposed efficient methods for software verification combining static and dynamic analysis, where static analysis reports possible runtime errors (some of which may be false alarms) and test generation confirms or rejects them. However, test generation may time out on real-sized programs before confirming some alarms as real bugs or rejecting some others as unreachable.To overcome this problem, we propose to reduce the source code by program slicing before test generation. This paper presents new optimized and adaptive usages of program slicing, provides underlying theoretical results and the algorithm these usages rely on. The method is implemented in a tool prototype called sante (Static ANalysis and TEsting). Our experiments show that our method with program slicing outperforms previous combinations of static and dynamic analysis. Moreover, simplifying the program makes it easier to analyze detected errors and remaining alarms.

Malware classification plays an important role in tracing the attack sources of computer security. However, existing static analysis methods are fast in classification, but they are inefficient in some malware using packing and obfuscation techniques; the dynamic analysis methods have better universality for packing and obfuscation, but they will cause excessive classification cost. To overcome these shortcomings, in this paper, we propose a classification system Malscore based on the probability scoring and machine learning, which sets the probability threshold to concatenate static analysis (called Phase 1) and dynamic analysis (called Phase 2). The convolutional neural networks with spatial pyramid pooling were used to analyze the grayscale images (static features) in Phase 1, and the variable n-grams and machine learning were used to analyze the native API call sequences (dynamic features) in Phase 2. Malscore combined static analysis with dynamic analysis not only accelerated the static analysis process by taking advantage of the CNN in image recognition but also appeared to be more resilient to obfuscation by the dynamic analysis. Different from other static and dynamic analysis techniques, when malware is detected, due to the fact that malware will most likely be labeled only by static analysis, we could reduce the overheads by dynamically analyzing a few malware that has less obvious features or greater confusion in static analysis. We performed experiments on 174607 malware samples from 63 malware families. The result showed that Malscore achieved 98.82% accuracy for malware classification. Furthermore, Malscore was compared with the method of using static and dynamic analysis. The preprocessing and test time represented a reduction of 59.58% and 61.70%, respectively.

The past decade has witnessed an explosive increase in the scale, intensity and sophistication of cyber attacks. While software vendors have significantly increased their efforts on security, they are almost always playing catch up. As a result, security-conscious organizations and individuals have come to expect their system administrators to deploy an array of tools and techniques to stay a step ahead of the hackers. While developer-oriented security tools rely mainly on static analysis, runtime analysis and policy enforcement are the mechanisms of choice in administrator-oriented tools. Runtime techniques offer increased automation and precision over static analysis, thus addressing the needs of administrators who don't have the time or resources needed to acquire extensive knowledge about the internals of a software system. In this talk, I will begin by summarizing some of the significant advances that have been achieved in the past few years in the context of software vulnerability mitigation, including buffer overflow defenses, and more recently, the impressive results that have been achieved using dynamic information-flow analysis for blocking the most popular exploits today, including SQL and command injection and cross-site scripting. I will then proceed to describe dynamic analysis and enforcement techniques aimed at another high-profile security problem faced today, namely, malware defense. Our initial target in this regard has been on dynamic analysis techniques for extracting high-level models of program behavior. These models could be used in a variety of applications such as intrusion detection, vulnerability analysis and security policy verification. More recently, interesting advances have been made in the context of security policy development, where a combination of static and dynamic analysis techniques have been developed to synthesize low-level, enforceable policies that achieve a high-level goal such as protecting system integrity. Finally, I will conclude the talk with a discussion of some research opportunities and challenges in software security.

Static and dynamic program analysis techniques are important research areas in software security. Static analysis helps us locate vulnerabilities in a software by looking at the source code. Dynamic analysis helps us reason about the behavior of the software from information gathered at run-time. In this thesis, we are focusing on data flow analysis and heap analysis which are key static and dynamic program analysis techniques respectively.
\n
\nIn the first part of this thesis, we aim at detecting vulnerabilities in Android applications which have capability leaks. The security of the Android platform relies mainly on sandboxing applications and restricting their capabilities such that no application, by default, can perform any operations that would adversely impact other applications, the operating system, or the user. However, a recent research reported that a genuine but vulnerable application may leak its capabilities. When being leveraged, other applications can gain extra capabilities which they are not granted originally. We present DroidChecker, an Android application analyzing tool which searches for the aforementioned vulnerability in Android applications. DroidChecker uses interprocedural control flow graph searching and static taint checking to detect exploitable data paths in an Android application. We analyzed more than 1100 Android applications using DroidChecker and found 6 previously unknown vulnerable applications including the renowned Adobe Photoshop Express application. We also developed a malicious application that exploits the previously unknown vulnerability found in the Adobe Photoshop Express application. We showed that the malicious application, which is not granted any permissions, can access contacts on the phone with just a few lines of code.
\n
\nIn the second part of this thesis, we explore the use of heap analysis to extract software birthmarks. There are techniques like code obfuscation and watermarking which can make the source code of a program difficult to understand by humans and prove the ownership of the program. However, code obfuscation cannot avoid the source code being copied and a watermark can be defaced. A birthmark is a group of unique characteristics a program possesses that can be used to identify the program. We propose two novel dynamic birthmark systems based on the run-time heap. A dynamic birthmark is one that is extracted when the program is executing. Since it is based on the run-time behavior of the program, semantics-preserving transformations of the code like obfuscation cannot defeat dynamic birthmarks. In this regard, dynamic birthmarks are more robust compared with static birthmarks.
\n
\nTo the best of our knowledge, these are the first birthmark systems using heap analysis as the underlying technique. The basic idea is to take snapshots of the heap while the program is running. From the snapshots, heap graphs are constructed to model the referencing structure between objects. After going through some filtering and referencing processes, they become the birthmarks. The two birthmark systems have been devised to extract birthmarks for Java programs and JavaScript programs respectively. While the underlying ideas of the two birthmark systems are similar, the differences in nature of the two programming languages led to different implementation designs.

SummaryDebugging is crucial for producing reliable software. One of the effective bug localization techniques is spectral‐based fault localization (SBFL). It helps to locate a buggy statement by applying an evaluation metric to program spectra and ranking program components on the basis of the score it computes. SBFL is an example of a dynamic analysis – an analysis of computer program that is performed by executing it with sufficient number of test cases. Static analysis, on the other hand, is performed in a non‐runtime environment. We introduce a weighting technique by combining these two kinds of program analysis. Static analysis is performed to categorize program statements into different classes and giving them weights based on the likelihood of being buggy statement. Statements are finally ranked on the basis of the weights computed by statements' categorization (static analysis) and scores computed by SBFL metrics (dynamic analysis). We evaluate the performance of our technique on Siemens test suite and Flex (having seeded bugs seeded by expert developers), Sed (having mixture of real and seeded bugs), and Space (having real bugs). In our evaluation, proposed weighting technique improves the performance of a wide variety of fault localization metrics up to 20% on single bug datasets and up to 42% on multi‐bug datasets. Copyright © 2017 John Wiley & Sons, Ltd.

Contemporaneously, Security is a major mission in technological world, irrespective of domains, fields and technologies. Like other areas, Big Data and IOT too experiencing security issues, threats and attacks in every single minute. These attacks can be on different components of Big Data and IOT, like data stored on various nodes, clusters, propagated through networks, and via various components of the system or sensors. Big data security deals with the measures, techniques and tools used to protect both the data and analytics methods from attacks, threats, or other unauthorized activities. In this paper, To apply Security measures to overcome vulnerability of infrastructure, proposed a method called Malware Detection Kit (MDK). MDK comprises of static and dynamic analysis. Malware detection kit identifies attacks and threats. To detect attacks analysis is performed in two iterations. Whenever a new data enters into system, data undergoes first iteration of MDK, by static analysis it identifies threats if any. In the second iteration, file is submitted to automated dynamic analysis tools. The tool reports whether the file is malware on benign. Static Analysis is done by using Random Forest classifier, it produced high accuracy and low error rate for Malgenome dataset. Dynamic analysis is done by using automated sandboxes. Finally, this method recognises whether the file is benign or malware.

A secure software demands effective techniques for vulnerability detection during its development cycle. The practice of detecting security flaws before the deployment phase eliminates the risks that vulnerabilities may impose for the company. Static analysis and dynamic analysis techniques offer two complimentary approaches for checking vulnerabilities. Static analysis involves the scanning of source code or binary eliminating the need of executing it. This approach is fast and has no run time overhead. However, static analysis are quite imprecise and generate huge false positives and false negatives. On the other hand, dynamic analysis involves the running of the software. The problem of false positives and negatives is less in case of dynamic analysis because they analyze by running the test cases. But this approach requires large number of test cases to ensure a certain confidence level in detecting security bugs. This paper describes a methodology which integrates the two approaches in a complimentary manner. It adopts the strengths of the two and eliminates their weaknesses. We are currently dealing with buffer overflow vulnerability with pointer aliasing. However the idea can be extended to other vulnerabilities also for e.g memory related errors, race conditions( Time of Check to Time to Use vulnerability), dangling pointer vulnerability, integer errors etc.

Cryptomining malware (also referred to as cryptojacking) has changed the cyber threat landscape. Such malware exploits the victim’s CPU or GPU resources with the aim of generating cryptocurrency. In this paper, we study the potential of using deep learning techniques to detect cryptomining malware by utilizing both static and dynamic analysis approaches. To facilitate dynamic analysis, we establish an environment to capture the system call events of 1500 Portable Executable (PE) samples of the cryptomining malware. We also demonstrate how one can perform static analysis of PE files’ opcode sequences. In our study, we evaluate the performance of using Long Short-Term Memory (LSTM), Attention-based LSTM (ATT-LSTM), and Convolutional Neural Networks (CNN) on our sequential data (opcodes and system call invocations) for classification by a Softmax function. We achieve an accuracy rate of 95% in the static analysis and an accuracy rate of 99% in the dynamic analysis.

Dynamic program analysis is extremely successful both in code debugging and in malicious code attacks. Fuzzing, concolic, and monkey testing are instances of the more general problem of analysing programs by dynamically executing their code with selected inputs. While static program analysis has a beautiful and well established theoretical foundation in abstract interpretation, dynamic analysis still lacks such a foundation. In this paper, we introduce a formal model for understanding the notion of precision in dynamic program analysis. It is known that in sound-by-construction static program analysis the precision amounts to completeness. In dynamic analysis, which is inherently unsound, precision boils down to a notion of coverage of execution traces with respect to what the observer (attacker or debugger) can effectively observe about the computation. We introduce a topological characterisation of the notion of coverage relatively to a given (fixed) observation for dynamic program analysis and we show how this coverage can be changed by semantic preserving code transformations. Once again, as well as in the case of static program analysis and abstract interpretation, also for dynamic analysis we can morph the precision of the analysis by transforming the code. In this context, we validate our model on well established code obfuscation and watermarking techniques. We confirm the efficiency of existing methods for preventing control-flow-graph extraction and data exploit by dynamic analysis, including a validation of the potency of fully homomorphic data encodings in code obfuscation.

This paper presents an exergetic, exergoeconomic and environmental assessment of an existing high-performance building using both static and dynamic analyses. The IEA ECBCS framework is adopted for exergy analysis, whereas the SPECO method is used to implement the exergoeconomic analysis. The environmental impact is considered in a quantitative fashion. It is noted that a dynamic analysis using average hourly temperatures is preferred over a static analysis. However, if a simpler static analysis is to be used, an annual average temperature needs to be identified for specific climate zone and building type. For Istanbul, an average temperature of 14°C is recommended.

Dynamic analysis tools, such as those that detect data-races, verify memory safety, and identify information flow, have become a vital part of testing and debugging complex software systems. While these tools are powerful, their slow speed often limits how effectively they can be deployed in practice. Hybrid analysis speeds up these tools by using static analysis to decrease the work performed during dynamic analysis. In this paper we argue that current hybrid analysis is needlessly hampered by an incorrect assumption that preserving the soundness of dynamic analysis requires an underlying sound static analysis. We observe that, even with unsound static analysis, it is possible to achieve sound dynamic analysis for the executions which fall within the set of states statically considered. This leads us to a new approach, called optimistic hybrid analysis. We first profile a small set of executions and generate a set of likely invariants that hold true during most, but not necessarily all, executions. Next, we apply a much more precise, but unsound, static analysis that assumes these invariants hold true. Finally, we run the resulting dynamic analysis speculatively while verifying whether the assumed invariants hold true during that particular execution; if not, the program is reexecuted with a traditional hybrid analysis. Optimistic hybrid analysis is as precise and sound as traditional dynamic analysis, but is typically much faster because (1) unsound static analysis can speed up dynamic analysis much more than sound static analysis can and (2) verifications rarely fail. We apply optimistic hybrid analysis to race detection and program slicing and achieve 1.8x over a state-of-the-art race detector (FastTrack) optimized with traditional hybrid analysis and 8.3x over a hybrid backward slicer (Giri).

Most of the offshore wind turbines (OWT) recently installed in Europe, China and North America are in shallow water. However, unlocking the full potential of OWT lies in deeper waters. Jacket substructures have presented themselves as a reliable foundation concept for transitional water depth. This study focuses on the structural static and dynamic analysis of the traditional jacket substructures (with X and K bracing) and the recently patented three-legged twisted jackets (with a twisted angle of 30 and 60 degrees) for deployment in transitional water (beyond 60 m). To facilitate comparison, the dimensions of all the jackets remain the same, while, the geometric configurations are distinct. Static analysis was implemented to better understand the global load bearing behaviour of the jackets. First, the global displacement patterns at the tower top are compared. The individual reactions at mud-line were investigated, followed by the evaluation of the maximum von Mises stress. Subsequently, this research went on to investigate the effect of dynamic loading. In this dynamic analysis, three main critical points were considered, including the wave point (67 m), the platform and the tower top. A modal analysis was performed to compute the mode shapes and natural frequencies for all the jackets. The first five modes of all the jackets were also checked against the results available for the OC4 project. A similar analytical approach was adopted for the structural design of monopile or tripod foundations for offshore wind turbines. The results showed that in the static analysis both the traditional jackets and the twisted jackets were safe under the provided load combination. The twisted jacket proved to possess excellent structural behaviour compared to the traditional four-legged jackets, while maintaining the merits of lower material usage with fewer nodes. Analysing the von Mises stress revealed that the maximum stress occurred at the transition piece and close to the working platform. The modal analysis results of the jackets demonstrated that the twisted jackets (30 and 60 degrees) with the first natural frequency of 0.29 and 0.31 Hz fell under the soft-stiff design category whereas the traditional four-legged jackets were classified as stiff-stiff designs. The discovered structural performance of OWTs equipped with various jacket foundations contributes to the preliminary structural selection and optimal design of foundations of OWTs to be installed in transitional water.

This research investigates numerically the potential failure of different framed structures after removal of a corner column. This study is directed towards the role of the joint above the removed column in terms of framed structures stability and internal forces redistribution utilizing linear static, nonlinear static and nonlinear dynamic analysis procedures. First, the preliminary linear static analysis as a part of more detailed nonlinear static and dynamic analysis to model reinforced concrete frames is performed. For nonlinear numerical models, three different moment-rotation capacity curves are considered for the joint above the removed column. These curves are taken according to FEMA 356 regulation according to the reinforcement condition at the joint location to represent normal joint, anchorage deficient joint and shear deficient joint. In linear static models, the results confirmed that, the more moment the joint can resist at the removed column location, the less moment is generated at the beam’s other end. In nonlinear static analysis, the model with normal plastic hinge properties recorded a higher carrying capacity than the model with both shear and anchorage plastic hinges. Nonlinear dynamic analysis with less assumptions offer the more representative modeling for the considered case study which is obvious from its closer perdition of internal forces and deflection compared to the reference findings.

The Alternate Load Path (ALP) is a useful method that has generated a considerable recent research interest for the assessment of progressive collapse. The outcome of the ALP analysis can be assessed either using the force-based approach or the energy-based approach. The Unified Facilities Criteria (UFC- 4- 023-03) of progressive collapse guideline - have outlined that the force-based approach can either be analysed using static or dynamic analysis. The force-based approach using static analysis is preferable as it does not require a high level of skill and experience to operate the software plus no effort is required in scrutinising the validity of the analysis results output. However, utilising the static approach will eliminate the inertial effect in capturing the actual dynamic response of the collapsed structure. In recent years, the development of the energy-based progressive collapse assessment is attracting widespread interest from researchers in the field; as the approach can produce a similar structural response with the force-based dynamic analysis by only using static analysis. Most of the current energy-based progressive collapse assessments are developed following the requirements which are given in the progressive collapse guidelines provided by the Unified Facilities Criteria. However, little attention is given to the development of the energy-based approach using the Eurocode standards as a base guideline. This article highlights the merits of utilising the energy-based approach against the force-based approach for a collapsed structure and explains the collapse mechanism of a steel frame in the perspective of the energy concept. The state of the art of energy-based progressive collapse assessment for a structural steel frame is reviewed. The comprehensive review will include insights on the development of the energy-based method, assumptions, limitations, acceptance criterion and its applicability with the European standards. Finally, potential research gaps are discussed herein.

Dynamic response due to cable rupture in a transmission lines guyed towers