Towards semi-automated detection of trigger-based behavior for software security assurance

Dorottya Papp, L. Buttyán, Zhendong Ma

Research output: Chapter in Book/Report/Conference proceedingConference contribution

Abstract

A program exhibits trigger-based behavior if it performs undocumented, often malicious, functions when the environmental conditions and/or specific input values match some pre-specified criteria. Checking whether such hidden functions exist in the program is important for increasing trustworthiness of software. In this paper, we propose a framework to effectively detect trigger-based behavior at the source code level. Our approach is semi-automated: We use automated source code instrumentation and mixed concrete and symbolic execution to generate potentially suspicious test cases that may trigger hidden, potentially malicious functions. The test cases must be investigated by a human analyst manually to decide which of them are real triggers. While our approach is not fully automated, it greatly reduces manual work by allowing analysts to focus on a few test cases found by our automated tools.

Original languageEnglish
Title of host publicationARES 2017 - Proceedings of the 12th International Conference on Availability, Reliability and Security
PublisherAssociation for Computing Machinery
VolumePart F130521
ISBN (Electronic)9781450352574
DOIs
Publication statusPublished - Aug 29 2017
Event12th International Conference on Availability, Reliability and Security, ARES 2017 - Reggio Calabria, Italy
Duration: Aug 29 2017Sep 1 2017

Other

Other12th International Conference on Availability, Reliability and Security, ARES 2017
CountryItaly
CityReggio Calabria
Period8/29/179/1/17

Keywords

  • Mixed concrete and symbolic execution
  • Software security
  • Source code analysis
  • Static analysis
  • Trigger-based behavior

ASJC Scopus subject areas

  • Human-Computer Interaction
  • Computer Networks and Communications
  • Computer Vision and Pattern Recognition
  • Software

Fingerprint Dive into the research topics of 'Towards semi-automated detection of trigger-based behavior for software security assurance'. Together they form a unique fingerprint.

  • Cite this

    Papp, D., Buttyán, L., & Ma, Z. (2017). Towards semi-automated detection of trigger-based behavior for software security assurance. In ARES 2017 - Proceedings of the 12th International Conference on Availability, Reliability and Security (Vol. Part F130521). [a64] Association for Computing Machinery. https://doi.org/10.1145/3098954.3105821