Fig 4 - uploaded by Hyungwoo Kang
Content may be subject to copyright.
Download
View publication
Parse tree describing the program in Figure 3  

Parse tree describing the program in Figure 3  

Source publication
Fig. 1. Classic buffer overflow  
Fig. 4. Parse tree describing the program in Figure 3  
Fig. 5. Simplified parse tree for original tree in Figure 4  
Fig. 6. PDA M being able to recognize simplified parse tree in Figure 5  
+3 Fig. 7. Process of identification for security property modeled by PDA...
A Model for Security Vulnerability Pattern
Conference Paper
Full-text available
  • May 2006
Static analysis technology is used to find programming errors before run time. Unlike dynamic analysis technique which looks at the application state while it is being executed, static analysis technique does not require the application to be executed. In this paper, we classify security vulnerability patterns in source code and design a model to e...
Cite
Download full-text

Citations

View
Security Assessment Framework Using Static Analysis and Fault Injection
Conference Paper
Full-text available
  • Sep 2008
For large scale and residual software like network service, reliability is a critical requirement. Recent research has shown that most of network software still contains a number of bugs. Methods for automated detection of bugs in software can be classified into static analysis based on formal verification and runtime checking based on fault injection. In this paper, a framework for checking software security vulnerability is proposed. The framework is based on automated bug detection technologies, i.e. static analysis and fault injection, which are complementary each other. The proposed framework provides a new direction, in which various kinds of software can be checked its vulnerability by making use of static analysis and fault injection technology. In experiment on proposed framework, we find unknown vulnerability as well as known vulnerability in Windows network module.
View