Finding and Demonstrating Undesired Program Behavior

预测软件会做什么，不会做什么一直都很难。测试可能会产生假阴性，并遗漏问题：它们只能涵盖可能执行的一小部分，因此无法保证未来的执行。另一方面，静态代码分析的精度随着程序的增长而降低，从而导致误报或误报警。在分析潜在的恶意软件时，这个问题变得很严重，因为这些软件可能会主动阻碍他们的分析：例如，在运行时，程序可能会检测到它是动态分析的，并因此关闭恶意行为。另一方面，通过在运行时加载和解密代码可以使静态分析变得不可能。在目标模糊技术的存在下，静态和动态分析都变得无能为力。验证项目旨在恢复预测软件行为的精度和有效性。其核心思想是结合静态分析、自动测试生成和动态分析各自的长处：1.通过测试生成展示潜在的问题。我们使用静态分析来检测软件中的潜在问题(例如，不需要的信息流)。我们让这样的潜在问题引导自动测试生成来见证执行；这些证明潜在问题确实可能在真实的执行中表现出来。换句话说，我们会自动生成针对潜在问题的漏洞。用动态信息加强静态分析。自动测试生成的系统目标是最大限度地覆盖程序行为。作为一个副作用，这意味着所有程序代码都要加载和解密。随着执行的进行，我们可以静态地分析新的程序代码，预测代码的用途，并再次指导测试生成潜在的问题。TESTIFY专门针对Android平台，该平台以其丰富的恶意程序而闻名。有了证言，安全分析师、开发人员、应用商店管理员和最终用户都可以评估应用程序的不良行为。Nexify通过真实的输入来演示每个问题，从而产生关于问题如何表现的准确信息：“如果服务器恶意控制.io发送了一条‘Record’消息，应用程序将开始静默地记录所有音频。”

Predicting what software will do and will not do has always been hard. Testing can produce false negatives, and miss issues: They can only cover a fraction of the possible executions, and therefore can give no guarantees about future executions. On the other hand, the precision of static code analysis diminishes as programs grow, leading to false positives, or false alarms.The problem becomes significant when analyzing potentially malicious software, as these can actively thwart their analysis: At runtime, for instance, a program may detect that it is analyzed dynamically, and turn off malicious behavior as a consequence. Static analysis, on the other hand, can be made impossible by loading and decrypting code at runtime. In the presence of targeted obfuscation techniques, both static and dynamic analysis become effectively powerless.The TESTIFY project aims at restoring precision and effectiveness as it comes to predicting software behavior. The key idea is to combine the respective strengths of static analysis, automatic test generation and dynamic analysis:1. DEMONSTRATE POTENTIAL ISSUES THROUGH TEST GENERATION. We use static analysis to detect potential issues in software (say, an undesired information flow). We let such potential issues guide _automatic test generation_ to produce witness executions; these prove that a potential issue may indeed manifest itself in a real execution. In other words, we automatically generate exploits for potential issues.2. STRENGTHEN STATIC ANALYSIS WITH DYNAMIC INFORMATION. Automatic test generation systematically aims at maximum coverage of program behavior. As a side effect, this means that all program code be loaded and decrypted. As execution progresses, we can thus analyze the new program code statically, predict what the code is up to, and again guide test generation towards potential issues.TESTIFY specifically targets the Android platform, known for its abundance of malicious programs. With TESTIFY, security analysts, developers, app store curators, and end users can all assess apps for undesired behavior. TESTIFY demonstrates each issue by a real input, and consequently, produces exact information on how the issue manifests itself: "If the server malwarecontrol.io sends a 'RECORD' message, the app will silently start recording all audio."