Automated software vulnerability detection by leveraging open source knowledge

点击翻译按钮获取中文摘要

Wind River System is a global leader in delivering software for the intelligent edge. Although Wind River and other software engineering practitioners have spent efforts on detecting and removing the vulnerabilities from their software, the ever increasing complexity and scale of software projects makes the tasks challenging. On the other hand, the open source community often shares knowledge about the discovered vulnerabilities online. Therefore, in this proposal, we plan to leveraging knowledge from the open source community in order to assist in software vulnerability detection. in particular, we design approaches that discover the discussion of software vulnerabilities from open forums and identify the associated source code in the discussion. With the identified source code, we plan to apply code clone detection and code search approaches to detect the existence of similar vulnerabilities inside other software projects, e.g., the source code from Wind River System. The proposed research will result in reports that can be shared regularly about the known vulnerabilities and approaches that automatically detect such vulnerabilities. The reports and the approaches can benefit the practitioners in Wind River System and other software engineering practitioners in Canada and the world.