Optimistic Hybrid Analysis

Achieving comprehensive code quality and ensuring software reliability are critical goals in modern software engineering. This paper delves into advanced strategies that encompass both technical and organizational practices, aiming to enhance code quality and boost software reliability. Key strategies include the implementation of rigorous code review processes, adoption of automated testing frameworks, and the utilization of static and dynamic code analysis tools. Firstly, rigorous code review processes are fundamental for maintaining high standards of code quality. By fostering a collaborative environment where peer reviews are routine, teams can catch potential issues early, ensure adherence to coding standards, and promote knowledge sharing. This practice not only improves code quality but also enhances team cohesion and expertise. Secondly, automated testing frameworks are indispensable in achieving comprehensive test coverage and reducing the incidence of bugs. Unit tests, integration tests, and end-to-end tests, when automated, provide continuous feedback and ensure that code changes do not introduce new defects. This continuous testing approach is crucial for maintaining software reliability, especially in agile and DevOps environments where rapid iterations are common. Furthermore, the integration of static and dynamic code analysis tools into the development pipeline offers additional layers of quality assurance. Static analysis tools inspect the codebase for potential vulnerabilities, code smells, and compliance with coding standards without executing the program. Dynamic analysis tools, on the other hand, evaluate the software during runtime to detect memory leaks, concurrency issues, and performance bottlenecks. Together, these tools provide a comprehensive assessment of the code’s health and reliability. Moreover, fostering a culture of continuous improvement and learning within the development team is essential. Regular training sessions, workshops, and knowledge-sharing activities help in keeping the team updated with the latest advancements in software engineering practices and tools. Encouraging a mindset of quality-first and reliability among developers ensures long-term benefits and sustainability. In conclusion, achieving comprehensive code quality and ensuring software reliability require a multifaceted approach that integrates rigorous code reviews, automated testing frameworks, and both static and dynamic analysis tools. Coupled with a strong culture of continuous learning and improvement, these strategies collectively contribute to the development of robust, reliable, and high-quality software systems. Keywords: Software Reliability, Code Quality, Advanced, Strategies, Comprehensive.

Malware classification plays an important role in tracing the attack sources of computer security. However, existing static analysis methods are fast in classification, but they are inefficient in some malware using packing and obfuscation techniques; the dynamic analysis methods have better universality for packing and obfuscation, but they will cause excessive classification cost. To overcome these shortcomings, in this paper, we propose a classification system Malscore based on the probability scoring and machine learning, which sets the probability threshold to concatenate static analysis (called Phase 1) and dynamic analysis (called Phase 2). The convolutional neural networks with spatial pyramid pooling were used to analyze the grayscale images (static features) in Phase 1, and the variable n-grams and machine learning were used to analyze the native API call sequences (dynamic features) in Phase 2. Malscore combined static analysis with dynamic analysis not only accelerated the static analysis process by taking advantage of the CNN in image recognition but also appeared to be more resilient to obfuscation by the dynamic analysis. Different from other static and dynamic analysis techniques, when malware is detected, due to the fact that malware will most likely be labeled only by static analysis, we could reduce the overheads by dynamically analyzing a few malware that has less obvious features or greater confusion in static analysis. We performed experiments on 174607 malware samples from 63 malware families. The result showed that Malscore achieved 98.82% accuracy for malware classification. Furthermore, Malscore was compared with the method of using static and dynamic analysis. The preprocessing and test time represented a reduction of 59.58% and 61.70%, respectively.

Contemporaneously, Security is a major mission in technological world, irrespective of domains, fields and technologies. Like other areas, Big Data and IOT too experiencing security issues, threats and attacks in every single minute. These attacks can be on different components of Big Data and IOT, like data stored on various nodes, clusters, propagated through networks, and via various components of the system or sensors. Big data security deals with the measures, techniques and tools used to protect both the data and analytics methods from attacks, threats, or other unauthorized activities. In this paper, To apply Security measures to overcome vulnerability of infrastructure, proposed a method called Malware Detection Kit (MDK). MDK comprises of static and dynamic analysis. Malware detection kit identifies attacks and threats. To detect attacks analysis is performed in two iterations. Whenever a new data enters into system, data undergoes first iteration of MDK, by static analysis it identifies threats if any. In the second iteration, file is submitted to automated dynamic analysis tools. The tool reports whether the file is malware on benign. Static Analysis is done by using Random Forest classifier, it produced high accuracy and low error rate for Malgenome dataset. Dynamic analysis is done by using automated sandboxes. Finally, this method recognises whether the file is benign or malware.

Static and dynamic program analysis techniques are important research areas in software security. Static analysis helps us locate vulnerabilities in a software by looking at the source code. Dynamic analysis helps us reason about the behavior of the software from information gathered at run-time. In this thesis, we are focusing on data flow analysis and heap analysis which are key static and dynamic program analysis techniques respectively.
\n
\nIn the first part of this thesis, we aim at detecting vulnerabilities in Android applications which have capability leaks. The security of the Android platform relies mainly on sandboxing applications and restricting their capabilities such that no application, by default, can perform any operations that would adversely impact other applications, the operating system, or the user. However, a recent research reported that a genuine but vulnerable application may leak its capabilities. When being leveraged, other applications can gain extra capabilities which they are not granted originally. We present DroidChecker, an Android application analyzing tool which searches for the aforementioned vulnerability in Android applications. DroidChecker uses interprocedural control flow graph searching and static taint checking to detect exploitable data paths in an Android application. We analyzed more than 1100 Android applications using DroidChecker and found 6 previously unknown vulnerable applications including the renowned Adobe Photoshop Express application. We also developed a malicious application that exploits the previously unknown vulnerability found in the Adobe Photoshop Express application. We showed that the malicious application, which is not granted any permissions, can access contacts on the phone with just a few lines of code.
\n
\nIn the second part of this thesis, we explore the use of heap analysis to extract software birthmarks. There are techniques like code obfuscation and watermarking which can make the source code of a program difficult to understand by humans and prove the ownership of the program. However, code obfuscation cannot avoid the source code being copied and a watermark can be defaced. A birthmark is a group of unique characteristics a program possesses that can be used to identify the program. We propose two novel dynamic birthmark systems based on the run-time heap. A dynamic birthmark is one that is extracted when the program is executing. Since it is based on the run-time behavior of the program, semantics-preserving transformations of the code like obfuscation cannot defeat dynamic birthmarks. In this regard, dynamic birthmarks are more robust compared with static birthmarks.
\n
\nTo the best of our knowledge, these are the first birthmark systems using heap analysis as the underlying technique. The basic idea is to take snapshots of the heap while the program is running. From the snapshots, heap graphs are constructed to model the referencing structure between objects. After going through some filtering and referencing processes, they become the birthmarks. The two birthmark systems have been devised to extract birthmarks for Java programs and JavaScript programs respectively. While the underlying ideas of the two birthmark systems are similar, the differences in nature of the two programming languages led to different implementation designs.

Dynamic program analysis is extremely successful both in code debugging and in malicious code attacks. Fuzzing, concolic, and monkey testing are instances of the more general problem of analysing programs by dynamically executing their code with selected inputs. While static program analysis has a beautiful and well established theoretical foundation in abstract interpretation, dynamic analysis still lacks such a foundation. In this paper, we introduce a formal model for understanding the notion of precision in dynamic program analysis. It is known that in sound-by-construction static program analysis the precision amounts to completeness. In dynamic analysis, which is inherently unsound, precision boils down to a notion of coverage of execution traces with respect to what the observer (attacker or debugger) can effectively observe about the computation. We introduce a topological characterisation of the notion of coverage relatively to a given (fixed) observation for dynamic program analysis and we show how this coverage can be changed by semantic preserving code transformations. Once again, as well as in the case of static program analysis and abstract interpretation, also for dynamic analysis we can morph the precision of the analysis by transforming the code. In this context, we validate our model on well established code obfuscation and watermarking techniques. We confirm the efficiency of existing methods for preventing control-flow-graph extraction and data exploit by dynamic analysis, including a validation of the potency of fully homomorphic data encodings in code obfuscation.

The past decade has witnessed an explosive increase in the scale, intensity and sophistication of cyber attacks. While software vendors have significantly increased their efforts on security, they are almost always playing catch up. As a result, security-conscious organizations and individuals have come to expect their system administrators to deploy an array of tools and techniques to stay a step ahead of the hackers. While developer-oriented security tools rely mainly on static analysis, runtime analysis and policy enforcement are the mechanisms of choice in administrator-oriented tools. Runtime techniques offer increased automation and precision over static analysis, thus addressing the needs of administrators who don't have the time or resources needed to acquire extensive knowledge about the internals of a software system. In this talk, I will begin by summarizing some of the significant advances that have been achieved in the past few years in the context of software vulnerability mitigation, including buffer overflow defenses, and more recently, the impressive results that have been achieved using dynamic information-flow analysis for blocking the most popular exploits today, including SQL and command injection and cross-site scripting. I will then proceed to describe dynamic analysis and enforcement techniques aimed at another high-profile security problem faced today, namely, malware defense. Our initial target in this regard has been on dynamic analysis techniques for extracting high-level models of program behavior. These models could be used in a variety of applications such as intrusion detection, vulnerability analysis and security policy verification. More recently, interesting advances have been made in the context of security policy development, where a combination of static and dynamic analysis techniques have been developed to synthesize low-level, enforceable policies that achieve a high-level goal such as protecting system integrity. Finally, I will conclude the talk with a discussion of some research opportunities and challenges in software security.

Recent research proposed efficient methods for software verification combining static and dynamic analysis, where static analysis reports possible runtime errors (some of which may be false alarms) and test generation confirms or rejects them. However, test generation may time out on real-sized programs before confirming some alarms as real bugs or rejecting some others as unreachable.To overcome this problem, we propose to reduce the source code by program slicing before test generation. This paper presents new optimized and adaptive usages of program slicing, provides underlying theoretical results and the algorithm these usages rely on. The method is implemented in a tool prototype called sante (Static ANalysis and TEsting). Our experiments show that our method with program slicing outperforms previous combinations of static and dynamic analysis. Moreover, simplifying the program makes it easier to analyze detected errors and remaining alarms.

Data security has become an increasingly important topic as information stored and transmitted in electronic form has become the preferred method. In order to protect this information, developers need to follow, at minimum, some basic guidelines to secure this data from malicious attackers. However, security often takes a backseat while developing software and is either not implemented at all or is patched into the software at the end. Both are undesirable as it leave the software vulnerable to sensitive data leaks and lowers the overall quality of the application. These issues can be introduced by developers of any skill level. Existing static or dynamic analysis tool does not provide the functionality of interaction with user, which we believe can be an extremely valuable feature. We present Secure Sensitive Data (SSD) Eclipse IDE plug-in that can help bridge the gap in sensitive data leaks by aiding software developers interactively by pointing out issues in real-time and enforcing certain standards to protect sensitive data. Our SSD plugin enforces five best practices and standards that should at minimum keep data encrypted and proper handling of sensitive data. By continuously involving and reminding the developers of the security implications, SSD helps to mitigate security flaws in future software applications.

Optimal allocation of Var source involves optimal location and determination of the size of the Var source. The purpose is to find the right tradeoff between the investment cost of the new Var source and the benefits in system operation derived from the presence of the additional reactive compensators. Traditionally, the locations for placing new Var sources were either simply estimated or directly assumed. This paper categorizes the literature relevant to optimal allocation of shunt dynamic Var source SVC and STATCOM, based on the voltage stability analysis tools used. Those tools include static voltage stability analysis ones such as P-V and V-Q curve analysis, continuation power flow (CPF), optimization methods (OPF), modal analysis, saddle-node bifurcation analysis, and dynamic voltage stability analysis ones such as Hopf bifurcation analysis and time-domain simulation. Static voltage stability analysis techniques are also used in dynamic Var planning. At the end of the paper, the advantages of static and dynamic voltage stability analysis tools are summarized. (7 pages)

Many dynamic analysis tools for programs written in managed languages such as Java rely on bytecode instrumentation. Tool development is often tedious because of the use of low-level bytecode manipulation libraries. While aspect-oriented programming (AOP) offers high-level abstractions to concisely express certain dynamic analyses, the join point model of mainstream AOP languages such as AspectJ is not well suited for many analysis tasks and the code generated by weavers in support of certain language features incurs high overhead. In this paper we introduce DiSL (domain-specific language for instrumentation), a new language especially designed for dynamic program analysis. DiSL offers an open join point model where any region of bytecodes can be a shadow, synthetic local variables for efficient data passing, efficient access to comprehensive static and dynamic context information, and weave-time execution of user-defined static analysis code. We demonstrate the benefits of DiSL with a case study, recasting an existing dynamic analysis tool originally implemented in AspectJ. We show that the DiSL version offers better code coverage, incurs significantly less overhead, and eases the integration of new analysis features that could not be expressed in AspectJ.

A secure software demands effective techniques for vulnerability detection during its development cycle. The practice of detecting security flaws before the deployment phase eliminates the risks that vulnerabilities may impose for the company. Static analysis and dynamic analysis techniques offer two complimentary approaches for checking vulnerabilities. Static analysis involves the scanning of source code or binary eliminating the need of executing it. This approach is fast and has no run time overhead. However, static analysis are quite imprecise and generate huge false positives and false negatives. On the other hand, dynamic analysis involves the running of the software. The problem of false positives and negatives is less in case of dynamic analysis because they analyze by running the test cases. But this approach requires large number of test cases to ensure a certain confidence level in detecting security bugs. This paper describes a methodology which integrates the two approaches in a complimentary manner. It adopts the strengths of the two and eliminates their weaknesses. We are currently dealing with buffer overflow vulnerability with pointer aliasing. However the idea can be extended to other vulnerabilities also for e.g memory related errors, race conditions( Time of Check to Time to Use vulnerability), dangling pointer vulnerability, integer errors etc.

Cryptomining malware (also referred to as cryptojacking) has changed the cyber threat landscape. Such malware exploits the victim’s CPU or GPU resources with the aim of generating cryptocurrency. In this paper, we study the potential of using deep learning techniques to detect cryptomining malware by utilizing both static and dynamic analysis approaches. To facilitate dynamic analysis, we establish an environment to capture the system call events of 1500 Portable Executable (PE) samples of the cryptomining malware. We also demonstrate how one can perform static analysis of PE files’ opcode sequences. In our study, we evaluate the performance of using Long Short-Term Memory (LSTM), Attention-based LSTM (ATT-LSTM), and Convolutional Neural Networks (CNN) on our sequential data (opcodes and system call invocations) for classification by a Softmax function. We achieve an accuracy rate of 95% in the static analysis and an accuracy rate of 99% in the dynamic analysis.

This paper provides a comprehensive analysis of the impact of wind farm integration on the stability of an electrical power system, with a particular focus on the dynamic effects induced by wind power during severe system disturbances. The primary objective is to evaluate how wind power integration influences system behavior, particularly under fault conditions. The research utilized the IEEE 9-bus test system, which consists of three generators and nine buses, as a reference benchmark for the stability analysis. Simulations and modeling were performed using PSAT (Power System Analysis Toolbox), a robust tool for static, dynamic, and control analysis of power systems, integrated with Matlab. The study specifically investigated the effects of a three-phase short circuit, representing a significant system disturbance. The dynamic analysis was structured into three phases: pre-fault, fault, and post-fault, to capture the complete impact on system behavior. The results provided valuable insights into critical electrical and electromechanical variables, shedding light on the role of wind farms in maintaining the stability of the power grid, with particular emphasis on the transmission network's resilience and response to disturbances. This work offers a deeper understanding of the integration of renewable energy sources in enhancing grid stability during extreme events.

As an important program analysis method, taint analysis technology has been widely used in the field of vulnerability detection. However, the existing dynamic taint analysis needs to design instruction-by-instruction taint propagation rules, which is expensive and has a high false positive rate for identifying the implicit control flow of the target program. In view of the above problems, this paper proposes a dynamic taint analysis method nnTaint based on neural network for the existing taint-guided fuzzing technology, which has the characteristics of low cost and low false positives. Comparing nnTaint with the existing taint analysis tools, the operation efficiency is improved by 10.9%-18.8% compared with the traditional taint analysis, which reduces the cost of the existing dynamic taint analysis technology to a certain extent. On the LAVA-M testing datasets and GNU binutils program, nnTaint improves the edge coverage by 4.7%-16% compared with the existing taint-guided fuzzing tools, effectively improving the implicit control flow recognition accuracy of the existing dynamic taint analysis. The results show that nnTaint can improve the efficiency and accuracy of existing dynamic taint analysis tools.

The two broad approaches to discover properties of programs---static and dynamic analyses---have complementary strengths: static techniques perform exhaustive exploration and prove upper bounds on program behaviors, while the dynamic analysis of test cases provides concrete evidence of these behaviors and promise low false alarm rates. In this paper, we present DynaBoost, a system which uses information obtained from test executions to prioritize the alarms of a static analyzer. We instrument the program to dynamically look for dataflow behaviors predicted by the static analyzer, and use these results to bootstrap a probabilistic alarm ranking system, where the user repeatedly inspects the alarm judged most likely to be a real bug, and where the system re-ranks the remaining alarms in response to user feedback. The combined system is able to exploit information that cannot be easily provided by users, and provides significant improvements in the human alarm inspection burden: by 35% compared to the baseline ranking system, and by 89% compared to an unaided programmer triaging alarm reports.