Ontology model-based static analysis of security vulnerabilities

  • Authors:

  • Lian Yu;Shi-Zhong Wu;Tao Guo;Guo-Wei Dong;Cheng-Cheng Wan;Yin-Hang Jing

  • Affiliations:

  • School of Software and Microelectronics, Peking University, Beijing, China;China Information Technology Security Evaluation Center, Beijing, China;China Information Technology Security Evaluation Center, Beijing, China;China Information Technology Security Evaluation Center, Beijing, China;School of Software and Microelectronics, Peking University, Beijing, China;School of Software and Microelectronics, Peking University, Beijing, China

  • Venue:
  • ICICS'11 Proceedings of the 13th international conference on Information and communications security
  • Year:
  • 2011

Quantified Score

Hi-index 0.00

Visualization

Abstract

Static analysis technologies and tools have been widely adopted in detecting software bugs and vulnerabilities. However, traditional approaches have their limitations on extensibility and reusability due to their methodologies, and are unsuitable to describe subtle vulnerabilities under complex and unaccountable contexts. This paper proposes an approach of static analysis based on ontology model enhanced by program slicing technology for detecting software vulnerabilities. We use Ontology Web Language (OWL) to model the source code and Semantic Web Rule Language (SWRL) to describe the bug and vulnerability patterns. Program slicing criteria can be automatically extracted from the SWRL rules and adopted to slice the source code. A prototype of security vulnerability detection (SVD) tool is developed to show the validity of the proposed approach.