| Title | Towards Semi-automated Detection of Trigger-based Behavior for Software Security Assurance |
| Publication Type | Conference Paper |
| Year of Publication | 2017 |
| Authors | Papp, Dorottya, Buttyán, Levente, Ma, Zhendong |
| Conference Name | Proceedings of the 12th International Conference on Availability, Reliability and Security |
| Publisher | ACM |
| Conference Location | New York, NY, USA |
| ISBN Number | 978-1-4503-5257-4 |
| Keywords | composability, Mixed Concrete and Symbolic Execution, pubcrawl, Scalability, software assurance, software security, Source code analysis, static analysis, Trigger-based Behavior |
| Abstract | A program exhibits trigger-based behavior if it performs undocumented, often malicious, functions when the environmental conditions and/or specific input values match some pre-specified criteria. Checking whether such hidden functions exist in the program is important for increasing trustworthiness of software. In this paper, we propose a framework to effectively detect trigger-based behavior at the source code level. Our approach is semi-automated: We use automated source code instrumentation and mixed concrete and symbolic execution to generate potentially suspicious test cases that may trigger hidden, potentially malicious functions. The test cases must be investigated by a human analyst manually to decide which of them are real triggers. While our approach is not fully automated, it greatly reduces manual work by allowing analysts to focus on a few test cases found by our automated tools. |
| URL | http://doi.acm.org/10.1145/3098954.3105821 |
| DOI | 10.1145/3098954.3105821 |
| Citation Key | papp_towards_2017 |
Towards Semi-automated Detection of Trigger-based Behavior for Software Security Assurance