LAVA: Large-scale Automated Vulnerability Addition

被引：213

作者：

Dolan-Gavitt, Brendan ^{[1
]}

Hulin, Patrick ^{[2
]}

Kirda, Engin ^{[3
]}

Leek, Tim ^{[2
]}

Mambretti, Andrea ^{[3
]}

Robertson, Wil ^{[3
]}

Ulrich, Frederick ^{[2
]}

Whelan, Ryan ^{[2
]}

机构：

[1] NYU, New York, NY 10003 USA

[2] MIT, Lincoln Lab, Cambridge, MA 02139 USA

[3] Northeastern Univ, Boston, MA USA

来源：

2016 IEEE SYMPOSIUM ON SECURITY AND PRIVACY (SP) | 2016年

基金：

美国国家科学基金会;

关键词：

D O I：

10.1109/SP.2016.15

中图分类号：

TP301 [理论、方法];

学科分类号：

081202 ;

摘要：

Work on automating vulnerability discovery has long been hampered by a shortage of ground-truth corpora with which to evaluate tools and techniques. This lack of ground truth prevents authors and users of tools alike from being able to measure such fundamental quantities as miss and false alarm rates. In this paper, we present LAVA, a novel dynamic taint analysis-based technique for producing ground-truth corpora by quickly and automatically injecting large numbers of realistic bugs into program source code. Every LAVA bug is accompanied by an input that triggers it whereas normal inputs are extremely unlikely to do so. These vulnerabilities are synthetic but, we argue, still realistic, in the sense that they are embedded deep within programs and are triggered by real inputs. Using LAVA, we have injected thousands of bugs into eight real-world programs, including bash, tshark, and the GNU coreutils. In a preliminary evaluation, we found that a prominent fuzzer and a symbolic execution-based bug finder were able to locate some but not all LAVA-injected bugs, and that interesting patterns and pathologies were already apparent in their performance. Our work forms the basis of an approach for generating large ground-truth vulnerability corpora on demand, enabling rigorous tool evaluation and providing a high-quality target for tool developers.

引用

页码：110 / 121

页数：12

共 27 条

[11]

Keromytis, 2015, TUNABLE CYBER DEFENS

[12]

Kratkiewicz K. R. L., 2005, P WORKSH EV SOFTW DE

[13]

Lu S., 2005, WORKSH EV SOFTW DET

[14]

Meftah Barmak, 2005, WORKSH EV SOFTW DEF

[15]

Newsome James, 2005, NETW DISTR SYST S ND

[16]

Rinard M., 2005, OOPSLA 05 COMPANION, P21, DOI DOI 10.1145/1094855.1094866

[17]

Ruwase O., 2004, NDSS

[18]

Shiraishi S., 2015, P 2015 IEEE INT S SO

[19]

TASC Inc., 2014, TECHNICAL REPORT

[20]

Tsyrklevich V., 2015, Hacking Team: a zero-day market case study

← 1 2 3 →