Skip to main content
Fachgebiete
Automobil + Motoren Bauwesen + Immobilien Business IT + Informatik Elektrotechnik + Elektronik Energie + Nachhaltigkeit Finance + Banking Management + Führung Marketing + Vertrieb Maschinenbau + Werkstoffe Versicherung + Risiko
DE
EN
Bücher
Zeitschriften
Themenseiten
Organisationspsychologie Projektmanagement Marketing Smart Manufacturing
Weitere Formate
Podcasts Webinare Technik Webinare Wirtschaft Kongresse Veranstaltungskalender Awards
Jetzt Einzelzugang starten
Zugang für Unternehmen
Referenzkunden
SLX-Digitalkonferenz: Zukunftswerkstatt 2024

Mehr Umsatz mit Top-Kontakten

Am 7. Mai erfahren Sie, wie Vertriebsteams Leadgenerierung, Leadnurturing und Leadstrategien effizient steuern können.
Erweiterte Suche
Anmelden
nach oben
Automatic Control and Computer Sciences
Erschienen in: Automatic Control and Computer Sciences 8/2018

01.12.2018

An Approach to Vulnerability Searching of Integer Overflows in the Executable Program Code

verfasst von: R. A. Demidov, A. I. Pechenkin, P. D. Zegzhda

Erschienen in: Automatic Control and Computer Sciences | Ausgabe 8/2018

Einloggen, um Zugang zu erhalten

Aktivieren Sie unsere intelligente Suche, um passende Fachinhalte oder Patente zu finden.

search-config
loading …

Abstract—

This article proposes an approach to identifying integer overflow vulnerabilities in software represented by the executable code of x86 architecture. The approach is based on symbolic code execution and initially twofold representation of memory cells. A truncated control transfer graph is constructed from the machine code of the program, the paths in which are layer-by-layer checked for the feasibility of the vulnerability conditions. The proposed methods were implemented in practice and experimentally tested on the various code samples.
Vorheriger Artikel A Blockchain Decentralized Public Key Infrastructure Model
Nächster Artikel Modeling the Dissemination of Information Threats in Social Media
Literatur
1.
Pechenkin, A.I. and Lavrova, D.S., Modeling the search for vulnerabilities via the fuzzing method using an automation representation of network protocols, Autom. Control Comput. Sci., 2015, vol. 49, no. 8, pp. 826–833.
2.
Pechenkin, A.I. and Nikolskiy, A.V., Architecture of a scalable system of fuzzing network protocols on a multiprocessor cluster, Autom. Control Comp. Sci., 2015, vol. 49, no. 8, pp. 758–765.
3.
Godefroid, P., Microsoft Research, Fuzzing @ Microsoft—A Research Perspective, ACSC 2017.
4.
Boyer, R.S., Elspas, B., and Levitt, K.N., SELECT—a formal system for testing and debugging programs by symbolic execution, Proceedings of the International Conference on Reliable Software, Los Angeles, 1975, pp. 234–245.
5.
King, J.C., Symbolic execution and program testing, Commun. ACM, 1976, vol. 19, no. 7.
6.
Prateek Saxena, Pongsin Poosankam, Stephen McCamant, and Dawn Song, Loop-extended symbolic execution on binary programs, Proceedings of the ACM/SIGSOFT International Symposium on Software Testing and Analysis (ISSTA), 2009.
7.
Chipounov, V., Georgescu, V., Zamfir, C., and Candea, G., Selective symbolic execution, Proceedings of the 5th Workshop on Hot Topics in System Dependability (HotDep), Lisbon, 2009.
8.
Stephens, N., Grosen, J., Salls, C., Dutcher, A., Wang, R., Corbetta, J., Shoshitaishvili, Y., Kruegel, C., and Vigna, G., Driller: Augmenting fuzzing through selective symbolic execution, Network and Distributed System Security Symposium, 2016.
9.
Sang Kil Cha, Avgerinos, T., Rebert, A., and Brumley, D., Unleashing Mayhem on binary code, 2012 IEEE Symposium on Security and Privacy, 2012.
Metadaten
Titel
An Approach to Vulnerability Searching of Integer Overflows in the Executable Program Code
verfasst von
R. A. Demidov
A. I. Pechenkin
P. D. Zegzhda
Publikationsdatum
01.12.2018
Verlag
Pleiades Publishing
Erschienen in
Automatic Control and Computer Sciences / Ausgabe 8/2018
Print ISSN: 0146-4116
Elektronische ISSN: 1558-108X
DOI
https://doi.org/10.3103/S0146411618080102

Weitere Artikel der Ausgabe 8/2018

Automatic Control and Computer Sciences 8/2018 Zur Ausgabe

OriginalPaper

Architecture of the Protected Cloud Data Storage Using Intel SGX Technology

OriginalPaper

Implementation of Mandatory Access Control in Distributed Systems

OriginalPaper

Security Analysis Based on Controlling Dependences of Network Traffic Parameters by Wavelet Transformation

OriginalPaper

Hierarchical Software-Defined Security Management for Large-Scale Dynamic Networks

OriginalPaper

Providing Stable Operation of Self-Organizing Cyber-Physical System via Adaptive Topology Management Methods Using Blockchain-Like Directed Acyclic Graph

OriginalPaper

Prevention of Attacks on Dynamic Routing in Self-Organizing Adhoc Networks Using Swarm Intelligence

Neuer Inhalt

    Bildnachweise