SaTC: CORE: Medium: Augmenting Automated Vulnerability Analysis with Human Activity

点击翻译按钮获取中文摘要

Traditionally, human analysts have carried out the core analysis tasks when checking software programs for vulnerabilities, while using automated techniques as an aid. In this case, the humans are the orchestrators of the analysis process, and they delegate specific tasks to specific tools (such as a disassembler or a symbolic execution system), taking care of combining and composing the results of multiple tools. Because the automated analysis of binary programs has advanced to sophisticated techniques that scale to large sets of real-world binary programs, it is now proposed that we move to a new paradigm in which automated tools orchestrate the process, with tasks being delegated to humans when appropriate. The research investigates this new approach, in which human actions are leveraged when automated techniques are unable to deal with the semantically rich, application-specific aspects of applications, which are tasks that humans can carry out with little effort. The overall goal is to improve the capabilities of automated vulnerability analysis and patching. The research will develop a well-defined framework in which subtasks are modeled and assigned to actors in a principled way. For example, fuzzing is a technique commonly used in automated vulnerability analysis. This approach requires, as input, a set of test cases, or seeds, that exercise the functionality of the target binary. These seeds are then mutated to explore more and more of the code base and increase the chance of triggering bugs. The seed quality, in terms of how well they exercise the target program, has a scaling effect on the effectiveness of a fuzzer: the more coverage these test cases provide, the more code will be explored by mutating them. Unfortunately, the creation of high-quality test case seeds is a complicated problem, and this is generally seen as a human-provided input into a system.Because humans have an excellent understanding of the semantics of software, they are very effective at creating high-quality test cases. The proposed framework starts the analysis and then generates well-defined "seeding tasklet" to integrate human efforts in a systematic way that does not require expert-level human analysts.These simple tasks represent staged interactions with an application that an unskilled human can carry out (e.g., by executing a transaction or filling a form).Therefore, these tasks can be crowdsourced through various channels (such as Amazon's Mechanical Turk), and their results automatically merged into the overall vulnerability analysis process.The reliance on a formal, well-defined framework supports the discovery of unanticipated combinations of automation and actions performed by humans with different skill levels.By improving the state-of-the-art in binary analysis it is possible to analyze a larger number of binaries in a more complete way.As a result, more vulnerabilities are identified before deployment, contributing to the overall security of software applications, including those that are part of the critical infrastructure.