Improving computer security using extended static checking

被引：25

作者：

Chess, BV ^{[1
]}

机构：

[1] Univ Calif Santa Cruz, Dept Comp Sci, Santa Cruz, CA 95064 USA

来源：

2002 IEEE SYMPOSIUM ON SECURITY AND PRIVACY, PROCEEDINGS | 2002年

关键词：

D O I：

10.1109/SECPRI.2002.1004369

中图分类号：

TP [自动化技术、计算机技术];

学科分类号：

0812 ;

摘要：

We describe a method for finding security flaws in source code by way, of static analysis. The method is notable because it allows a user to specify a wide range of security properties while also leveraging a set of pre-defined common flaws. It works by using an automated theorem prover to analyze verification conditions generated from C source code and a set of specifications that define security properties. We demonstrate that the method can be used to identify real vulnerabilities in real programs.

引用

页码：160 / 173

页数：14