{'fraction_non_alphanumeric': 0.020506634499396863, 'fraction_numerical': 0.0016083634901487736, 'mean_word_length': 5.688172043010753, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Compiler assisted vulnerability assessment

With computer software pervading every aspect of our lives, vulnerabilities pose an active threat. Moreover, with shorter software development cycles and a security-asan-afterthought mindset, vulnerabilities in shipped code are inevitable. Therefore, recognizing and fixing vulnerabilities has gained in importance. At the same time, there is a demand for methods to diagnose vulnerabilities within the software development process. This dissertation introduces compiler assisted vulnerability assessment, a novel approach that brings together techniques from program analysis and software testing for recognizing vulnerabilities as software is written. The main idea behind our approach is to leverage compile-time analysis to abstract program information that is relevant for vulnerability assessment from source code. Our analysis is targeted at an in-memory code representation that exposes program syntax and semantics, making it both fast and precise. We show that our approach not only enables identification of well-studied vulnerability classes such as buffer overflows but also assists software testing and regression analysis. To this end, we develop three different methods for software vulnerability assessment, namely, a method to identify vulnerabilities spread across multiple source files, a method to infer the input format of parsing applications to test them more effectively, and a method to perform vulnerability template matching from fuzzer crashes. These methods address distinct tasks encountered by security practitioners on a regular basis. In doing so, they show how program-centric analyses and input-centric testing can complement each other towards vulnerability assessment. We evaluate our methods on popular open-source software (OSS), quantifying their benefit in terms of number of new vulnerabilities exposed, time to expose vulnerabilities, and test coverage improvement. Our tools have found tens of zero-day vulnerabilities in production software such as Open vSwitch and tcpdump, and improved test coverage by 10–15%. In controlled settings, they have speeded up the time to vulnerability exposure by an order of magnitude. Our work shows that compiler assisted analysis has the potential to reduce the likelihood of vulnerabilities propagating to production software. More importantly, it shows that static program analysis holds promise for advancing the state-of-the-art in vulnerability assessment.