Static analysis of source code security: Assessment of tools against SAMATE tests

Static code analysis is widely used to support the development of high-quality software. It helps developers detect potential bugs and security vulnerabilities in a program's source code without executing it. While the potential benefits of static analysis tools are beyond question, their usability is often criticised and prevents software developers from using static analysis to its full potential. In the past decade, researchers have studied developer needs and contrasted them to available static analysis tool functionalities. In this paper, we summarize the main design challenges for building usable static analysis tools, and show that they revolve around the notion of explainability, which is a subarea of usability. We present existing analysis tools and current research in static analysis usability, and detail how they approach those challenges. This leads us to proposing potential lines of future work in explainability for static analysis, namely turning static analysis tools into assistants and teachers.

Cyber-attacks are fairly mundane. The misconfigurations of the source code can result in security vulnerabilities that potentially encourage the attackers to exploit them and compromise the system. This paper aims to discover various mechanisms of automating the detection and correction of vulnerabilities in source code. Usage of static and dynamic analysis, various machine learning, deep learning, and neural network techniques will enhance the automation of detecting and correcting processes. This paper systematically presents the various methods and research efforts of detecting vulnerabilities in the source code, starting with what is a software vulnerability and what kind of exploitation, existing vulnerability detection methods, correction methods and efforts of best researches in the world relevant to the research area. A plugin will be developed which is capable of intelligently and efficiently detecting the vulnerable source code segment and correcting the source code accurately in the development stage.

Security vulnerabilities are weaknesses of software due for instance to design flaws or implementation bugs that can be exploited and lead to potentially devastating security breaches. Traditionally, static code analysis is recognized as effective in the detection of software security vulnerabilities but at the expense of a high human effort required for checking a large number of produced false positive cases. Deep-learning methods have been recently proposed to overcome such a limitation of static code analysis and detect the vulnerable code by using vulnerability-related patterns learned from large source code datasets. However, the use of these methods for localizing the causes of the vulnerability in the source code, i.e., localize the statements that contain the bugs, has not been extensively explored.

The life and death of statically detected vulnerabilities: An empirical study

To increase and maintain web application security, developers could use some different methods, one of them is static code analysis. This method could find security vulnerabilities inside a source code without the need of running the program. It could also be automated by using tools, which considered more efficient than manual reviews. One specific method which is commonly used in static code analysis is taint analysis. Taint analysis usually utilizes source code modeling to prepare the code for analysis process to detect any untrusted data flows into security sensitives computations. While this kind of analysis could be very helpful, static code analysis tool for Laravel-based web application is still quite rare, despite its popularity. Therefore, in this research, we want to know how static code (taint) analysis could be utilized to detect security vulnerabilities and how the projects (Laravel-based) should be modeled in order to facilitate this analysis. We then developed a static analysis tool, which models the application’s source code using AST and dictionary to be used as the base of the taint analysis. The tool first parsed the route file of Laravel project to get a list of controller files. Each file in that list would be parsed in order to build the source code representation, before actually being analyzed using taint analysis method. The experiments was done using this tool shows that the tools (with taint analysis) could detect 13 security vulnerabilities from 6 Laravel-based projects with one False Negative. An ineffective sanitizer was the suspected cause of this False Negative. This also shows that proposed modeling technique could be helpful in facilitating taint analysis in Laravel-based projects. For future development and studies, this tool should be tested with more Laravel and even other framework based web application with a wider range of security vulnerabilities.

Insecurity Refactoring is a change to the internal structure of software to inject a vulnerability without changing the observable behavior in a normal use case scenario. An implementation of Insecurity Refactoring is formally explained to inject vulnerabilities in source code projects by using static code analysis. It creates learning examples with source code patterns from known vulnerabilities.Insecurity Refactoring is achieved by creating an Adversary Controlled Input Dataflow tree based on a Code Property Graph. The tree is used to find possible injection paths. Transformation of the possible injection paths allows to inject vulnerabilities. Insertion of data flow patterns introduces different code patterns from related Common Vulnerabilities and Exposures (CVE) reports. The approach is evaluated on 307 open source projects. Additionally, insecurity-refactored projects are deployed in virtual machines to be used as learning examples. Different static code analysis tools, dynamic tools and manual inspections are used with modified projects to confirm the presence of vulnerabilities.The results show that in 8.1% of the open source projects it is possible to inject vulnerabilities. Different inspected code patterns from CVE reports can be inserted using corresponding data flow patterns. Furthermore the results reveal that the injected vulnerabilities are useful for a small sample size of attendees (n=16). Insecurity Refactoring is useful to automatically generate learning examples to improve software security training. It uses real projects as base whereas the injected vulnerabilities stem from real CVE reports. This makes the injected vulnerabilities unique and realistic.

The ability of the software engineering community to achieve high levels of reuse from software frameworks has been tempered by the difficulty in understanding how to reuse them properly. When written correctly, a plugin can take advantage of the framework's code and architecture to provide a rich application with relatively few lines of code. Unfortunately, doing this correctly is difficult because frameworks frequently require plugin developers to be aware of complex protocols between objects, and improper use of these protocols causes exceptions and unexpected behavior at run time. This dissertation introduces collaboration constraints, rules governing how multiple objects may interact in a complex protocol. These constraints are particularly difficult to understand and analyze because they may extend across type boundaries and even programming language boundaries. This thesis improves the state of the art through two mechanisms. First, it provides a deep understanding of these collaboration constraints and the framework designs which create them. Second, it introduces Fusion, an adoptable specification language and static analysis tool, that detects broken collaboration constraints in plugin code and demonstrates how to achieve this goal in a cost-effective manner that is practical for industry use. In this dissertation, I have done an empirical study of framework help forums which showed that collaboration constraints are burdensome for developers, as they take hours or even days to resolve. From this empirical study, I have identified several common properties of collaboration constraints. This motivated a new specification language, called Fusion, that is tailored for specifying collaboration constraints in a practical way. The specification language uses relationships to describe the abstract associations between objects and allows developers to specify collaboration constraints as logical predicates of relationships. Since a relationship is an abstraction above the code, this allows developers to easily specify constraints that cross type and language boundaries. There are three variants of the analysis: a sound variant that has false positives but no false negatives, a complete variant that has false negatives but no false positives, and a pragmatic variant that attempts to balance this tradeoff. In this dissertation, I successfully used Fusion to specify and analyze constraints from examples found in the help forums of the ASP.NET and Spring frameworks. Additionally, I ran Fusion on DaCapo, a 1.5 MLOC DaCapo benchmark for program analysis, to show that Fusion is scalable and provides precise enough results for industry with low specification cost. This dissertation examines many tradeoffs: the tradeoffs of framework designs, the tradeoffs of specification precision, and the tradeoffs of program analysis results are all featured. A central theme of this work is that there is no single right solution to collaboration constraints; there are only solutions that work better for a particular instance of the problem.

Static analysis tools (SATs) have the potential to assist developers in finding and fixing vulnerabilities in the early stages of software development, requiring them to be able to understand and act on tools’ notifications. To understand how helpful such SAT guidance is to developers, we ran an online experiment (N=132) where participants were shown four vulnerable code samples (SQL injection, hard-coded credentials, encryption, and logging sensitive data) along with SAT guidance, and asked to indicate the appropriate fix. Participants had a positive attitude towards both SAT notifications and particularly liked the example solutions and vulnerable code. Seeing SAT notifications also led to more detailed open-ended answers and slightly improved code correction answers. Still, most SAT (SpotBugs 67%, SonarQube 86%) and Control (96%) participants answered at least one code-correction question incorrectly. Prior software development experience, perceived vulnerability severity, and answer confidence all positively impacted answer accuracy.

The study explores the capabilities of these large language models in the domain of security analysis. Specifically, it investigates the models' ability to classify vulnerability types and descriptions from the CWE Top 25 category, which includes the most dangerous vulnerabilities for 2024 according to the CWE catalog ranking. To evaluate the models, several sets of specialized queries are constructed. These queries test the models' knowledge of vulnerability types as well as their ability to detect these types of vulnerabilities in source code. The experiments conducted with the models yielded a body of statistical data, allowing for an assessment of the models' effectiveness in the tasks of security analysis and vulnerability detection.

Static program analysis tools are often required to work with only a small part of a program’s source code, either due to the unavailability of the entire program or the lack of need to analyze the complete code. This makes it challenging to use static analysis tools that require a complete and typed intermediate representation (IR). We present JCoffee, a tool that leverages compiler feedback to convert partial Java programs into their compilable counterparts by simulating the presence of missing surrounding code. It works with any well-typed code snippet (class, function, or even an unenclosed group of statements) while making minimal changes to the input code fragment. A demo of the tool is available here: https://youtu.be/O4h2gn2Qls

BGNN4VD: Constructing Bidirectional Graph Neural-Network for Vulnerability Detection

Ethereum smart contracts are computer programs that are deployed and executed on the Ethereum blockchain to enforce agreements among untrusting parties. Being the most prominent platform that supports smart contracts, Ethereum has been targeted by many attacks and plagued by security incidents. Consequently, many smart contract vulnerabilities have been discovered in the past decade. To detect and prevent such vulnerabilities, different security analysis tools, including static and dynamic analysis tools, have been created, but their performance decreases drastically when codes to be analyzed are constantly being rewritten. In this paper, we propose Eth2Vec, a machine-learning-based static analysis tool that detects smart contract vulnerabilities. Eth2Vec maintains its robustness against code rewrites; i.e., it can detect vulnerabilities even in rewritten codes. Other machine-learning-based static analysis tools require features, which analysts create manually, as inputs. In contrast, Eth2Vec uses a neural network for language processing to automatically learn the features of vulnerable contracts. In doing so, Eth2Vec can detect vulnerabilities in smart contracts by comparing the similarities between the codes of a target contract and those of the learned contracts. We performed experiments with existing open databases, such as Etherscan, and Eth2Vec was able to outperform a recent model based on support vector machine in terms of well-known metrics, i.e., precision, recall, and F1-score.

Smart contracts are executable programs that enable the building of a\nprogrammable trust mechanism between multiple entities without the need of a\ntrusted third-party. Researchers have developed several security scanners in\nthe past couple of years. However, many of these analyzers either do not scale\nwell, or if they do, produce many false positives. This issue is exacerbated\nwhen bugs are triggered only after a series of interactions with the functions\nof the contract-under-test. A depth-n vulnerability, refers to a vulnerability\nthat requires invoking a specific sequence of n functions to trigger. Depth-n\nvulnerabilities are time-consuming to detect by existing automated analyzers,\nbecause of the combinatorial explosion of sequences of functions that could be\nexecuted on smart contracts.\n In this paper, we present a technique to analyze depth-n vulnerabilities in\nan efficient and scalable way by combining symbolic execution and data\ndependency analysis. A significant advantage of combining symbolic with static\nanalysis is that it scales much better than symbolic alone and does not have\nthe problem of false positive that static analysis tools typically have. We\nhave implemented our technique in a tool called MPro, a scalable and automated\nsmart contract analyzer based on the existing symbolic analysis tool\nMythril-Classic and the static analysis tool Slither. We analyzed 100 randomly\nchosen smart contracts on MPro and our evaluation shows that MPro is about\nn-times faster than Mythril-Classic for detecting depth-n vulnerabilities,\nwhile preserving all the detection capabilities of Mythril-Classic.\n

Cloud systems have been widely adopted by many real world production applications. Thus, security vulnerabilities in those cloud systems can cause serious widespread impact. Although previous intrusion detection systems can detect security attacks, understanding the underlying software defects that cause those security vulnerabilities is little studied. In this paper, we conduct a systematic study over 110 software security vulnera-bilities in 13 popular cloud server systems. To understand the underlying vulnerabilities, we answer the following questions: 1) what are the root causes of those security vulnerabilities? 2) what threat impact do those vulnerable code have? 3) how do developers patch those vulnerable code? Our results show that the vulnerable code of the studied security vulnerabilities comprise five common categories: 1) improper execution restrictions, 2) improper permission checks, 3) improper resource path-name checks, 4) improper sensitive data handling, and 5) improper synchronization handling. We further extract principal vulnerable code patterns from those common vulnerability categories.

Motivation: Certain studies use short-TE MRS to estimate metabolites such as gamma-aminobutyric acid. The findings of such studies hinge on the correlation of this technique to the gold-standard edited MRS technique. Goal(s): We investigate how the false negative rate and false positive rate of studies vary as a function of correlation between short-TE and MEGA-edited metabolite estimates. Approach: Simulated data was used to numerically estimate the false positive and false negative rates, using parameters obtained from the literature. Results: We show that these studies can have largely inflated false positive and false negative rates as compared to their nominally designed values. Impact: The false negative and false positive rate can be markedly inflated when using short-TE MRS to estimate metabolites such as gamma-aminobutyric acid. This calls for increased caution in interpreting results, and the accommodation of these effects when designing statistical analyses.