Abstract
Static analysis is an efficient approach for software assurance. It is indicated that its most effective usage is to perform analysis in an interactive way through the software development process, which has a high performance requirement. This paper concentrates on rule-based static analysis tools and proposes an optimized rule-checking algorithm. Our technique improves the performance of static analysis tools by filtering vulnerability rules in terms of characteristic objects before checking source files. Since a source file always contains vulnerabilities of a small part of rules rather than all, our approach may achieve better performance. To investigate our technique’s feasibility and effectiveness, we implemented it in an open source static analysis tool called PMD and used it to conduct experiments. Experimental results show that our approach can obtain an average performance promotion of 28.7% compared with the original PMD. While our approach is effective and precise in detecting vulnerabilities, there is no side effect.
Similar content being viewed by others
References
Alpuente, M., Feliú, M.A., Joubert, C., et al., 2009. Using Datalog and Boolean equation systems for program analysis. 13th Int. Workshop on Formal Methods for Industrial Critical Systems, p.215–231. http://dx.doi.org/10.1007/978-3-642-03240-0_18
Araújo, J.E.M., Souza, S., Valente, M.T., 2011. Study on the relevance of the warnings reported by Java bug-finding tools. IET Softw., 5(4): 366–374. http://dx.doi.org/10.1049/iet-sen.2009.0083
Atkinson, D.C., Griswold, W.G., 2006. Effective pattern matching of source code using abstract syntax patterns. Softw.-Pract. Exp., 36(4): 413–447. http://dx.doi.org/10.1002/spe.704
Ayewah, N., Pugh, W., Morgenthaler, J.D., et al., 2007. Evaluating static analysis defect warnings on production software. ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools & Engineering, p.1–8. http://dx.doi.org/10.1145/1251535.1251536
Ball, T., 2008. The verified software challenge: a call for a holistic approach to reliability. LNCS, 4171: 42–48. http://dx.doi.org/10.1007/978-3-540-69149-5_5
Bounimova, E., Godefroid, P., Molnar, D., 2013. Billions and billions of constraints: whitebox fuzz testing in production. 35th Int. Conf. on Software Engineering, p.122–131. http://dx.doi.org/10.1109/ICSE.2013.6606558
Bovet, J., Parr, T., 2008. ANTLRWorks: an ANTLR grammar development environment. Softw.-Pract. Exp., 38(12): 1305–1332. http://dx.doi.org/10.1002/spe.872
Chen, D., Huang, R., Qu, B., et al., 2014. Improving static analysis performance using rule-filtering technique. 26th Int. Conf. on Software Engineering and Knowledge Engineering, p.19–24.
Emanuelsson, P., Nilsson, U., 2008. A comparative study of industrial static analysis tools. Electron. Notes Theor. Comput. Sci., 217: 5–21. http://dx.doi.org/10.1016/j.entcs.2008.06.039
Engler, D., Chen, D.Y., Hallem, S., et al., 2001. Bugs as deviant behavior: a general approach to inferring errors in systems code. ACM SIGOPS Oper. Syst. Rev., 35(5): 57–72. http://dx.doi.org/10.1145/502059.502041
Hajiyev, E., Verbaere, M., de Moor, O., 2006. CodeQuest: scalable source code queries with Datalog. 20th European Conf. on Object-Oriented Programming, p.2–27. http://dx.doi.org/10.1007/11785477_2
Haydar, M., Petrenko, A., Boroday, S., et al., 2013. A formal approach for run-time verification of web applications using scope-extended LTL. Inform. Softw. Technol., 55(12): 2191–2208. http://dx.doi.org/10.1016/j.infsof.2013.07.013
Helmick, M.T., 2007. Interface-based programming assignments and automatic grading of Java programs. 12th Annual SIGCSE Conf. on Innovation & Technology in Computer Science Education, p.63–67. http://dx.doi.org/10.1145/1269900.1268805
Hovemeyer, D., Pugh, W., 2004. Finding bugs is easy. ACM SIGPLAN Not., 39(12): 92–106. http://dx.doi.org/10.1145/1052883.1052895
Hovemeyer, D., Pugh, W., 2007. Finding more null pointer bugs, but not too many. ACM SIGPLAN-SIGSOFT Workshop on Program Analysis for Software Tools & Engineering, p.9–14. http://dx.doi.org/10.1145/1251535.1251537
Jarzabek, S., 1998. Design of flexible static program analyzers with PQL. IEEE Trans. Softw. Eng., 24(3): 197–215. http://dx.doi.org/10.1109/32.667879
Liu, S., Zhang, R., Wang, D., et al., 2008. Implementing of Gaussian syntax-analyzer using ANTLR. Int. Conf. on Cyberworlds, p.613–618. http://dx.doi.org/10.1109/CW.2008.139
Loveland, S., 2009. Using open source tools to prevent writeonly code. 6th Int. Conf. on Information Technology: New Generations, p.671–677. http://dx.doi.org/10.1109/ITNG.2009.75
Martin, M., Livshits, B., Lam, M.S., 2005. Finding application errors and security flaws using PQL: a program query language. ACM SIGPLAN Not., 40(10): 365–383. http://dx.doi.org/10.1145/1103845.1094840
Panchenko, O., Treffer, A., Zeier, A., 2010. Towards query formulation and visualization of structural search results. ICSE Workshop on Search-Driven Development: Users, Infrastructure, Tools and Evaluation, p.33–36. http://dx.doi.org/10.1145/1809175.1809184
Panchenko, O., Karstens, J., Plattner, H., et al., 2011. Precise and scalable querying of syntactical source code patterns using sample code snippets and a database. 19th Int. Conf. on Program Comprehension, p.41–50. http://dx.doi.org/10.1109/ICPC.2011.31
Parr, T., Fisher, K., 2011. LL(*):the foundation of the ANTLR parser generator. ACM SIGPLAN Not., 46(6): 425–436. http://dx.doi.org/10.1145/1993316.1993548
Plosch, R., Gruber, H., Hentschel, A., et al., 2008. On the relation between external software quality and static code analysis. 32nd Annual IEEE Software Engineering Workshop, p.169–174. http://dx.doi.org/10.1109/SEW.2008.17
Rajamani, S.K., 2006. Automatic property checking for software: past, present and future. 4th IEEE Int. Conf. on Software Engineering and Formal Methods, p.18–20. http://dx.doi.org/10.1109/SEFM.2006.10
Reinbacher, T., Brauer, J., Horauer, M., et al., 2014. Runtime verification of microcontroller binary code. Sci. Comput. Program., 80(A):109–129. http://dx.doi.org/10.1016/j.scico.2012.10.015
Rutar, N., Almazan, C.B., Foster, J.S., 2004. A comparison of bug finding tools for Java. 15th Int. Symp. on Software Reliability Engineering, p.245–256. http://dx.doi.org/10.1109/ISSRE.2004.1
Schaps, G.L., 1999. Compiler construction with ANTLR and Java—tools for building tools. Dr. Dobb’s J., 24(3): 84–89.
Whaley, J., Avots, D., Carbin, M., et al., 2005. Using Datalog with binary decision diagrams for program analysis. Asian Symp. on Programming Languages and Systems, p.97–118. http://dx.doi.org/10.1007/11575467_8
Zook, D., Pasalic, E., Sarna-Starosta, B., 2009. Typed datalog. LCNS, 5418: 168–182. http://dx.doi.org/10.1007/978-3-540-92995-6_12
Author information
Authors and Affiliations
Corresponding author
Additional information
Project supported by the National High-Tech R&D Program (863) of China (No. 2013AA12A202), the National Natural Science Foundation of China (Nos. 61172173, 41501505, and 61502205), the Natural Science Foundation of Hubei Province, China (No. 2014CFB779), and the Youths Science Foundation of Wuhan Institute of Technology (No. K201546)
ORCID: Deng CHEN, http://orcid.org/0000-0001-6359-801X
Rights and permissions
About this article
Cite this article
Chen, D., Zhang, Yd., Wei, W. et al. Efficient vulnerability detection based on an optimized rule-checking static analysis technique. J. Zhejiang Univ. - Sci. C 18, 332–345 (2017). https://doi.org/10.1631/FITEE.1500379
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1631/FITEE.1500379