Improving Security Using Extensible Lightweight Static Analysis

Improving Security Using Extensible Lightweight Static Analysis (2002)

Cached

Download Links

Other Repositories/Bibliography

DBLP

by David Evans , David Larochelle , Security Attacks

Citations:

146 - 6 self

BibTeX

@MISC{Evans02improvingsecurity,
    author = {David Evans and David Larochelle and Security Attacks},
    title = {Improving Security Using Extensible Lightweight Static Analysis},
    year = {2002}
}

Years of Citing Articles

Bookmark

OpenURL

Abstract

This article describes a way to codify that knowledge. We describe Splint, a tool that uses lightweight static analysis to detect likely vulnerabilities in programs. Splint's analyses are similar to those done by a compiler. Hence, they are efficient and scalable, but they can detect a wide range of implementation flaws by exploiting annotations added to programs

Citations

467	Dynamically discovering likely program invariants to support program evolution - Ernst, Cockrell, et al. - 2001
340	A Secure Environment for Untrusted Helper Applications - Goldberg, Wagner, et al. - 1996
314	A first step towards automated detection of buffer overrun vulnerabilities - Wagner, Foster, et al. - 2000
158	Statically detecting likely buffer overflow vulnerabilities - Larochelle, Evans - 2001
156	Transparent run-time defense against stack-smashing attacks - Baratloo, Singh, et al. - 2000
146	Static detection of dynamic memory errors - Evans - 1996
71	The undecidability of aliasing - RAMALINGAM - 1994
33	et al. StackGuard: Automatic adaptive detection and prevention of buffer-overflow attacks - Cowan - 1998
17	G.: ITS4: A Static Vulnerability Scanner for C - Viega, Bloch, et al. - 2000
12	a C program checker. Computer Science - Lint - 1978
11	Programming Perl, 3rd edition. O’Reilly & Associates - Wall, Christiansen, et al. - 2000
3	et al., “FormatGuard: Automatic Protection From printf Format String Vulnerabilities - Cowan - 2001
2	Viega et al., “ITS4 : A Static Vulnerability Scanner for C and C - unknown authors - 2001
2	Static Error Checking of C Applications Ported from UNIX to WIN32 Systems Using LCLint,” senior thesis - Barker - 2001
2	et al. LCLint: A tool for using specifications to check code - Evans - 1994
1	2001. [3] Common Vulnerabilities and Exposures Version 20010918. Available from http://cve.mitre.org/. [4 - Barringer, Kroah-Hartman, et al.
1	FormatGuard: Automatic Protection From printf Format String Vulnerabilities. 10th USENIX Security Symposium, August 2001. [5 - Pu, Hinton, et al.
1	Santo Orcero. The Code Analyzer LCLint - David
1	16] Secure Software Solutions. Secure Software Announces Initial Release of RATS. http://www.securesw.com/rats - Talwar, Wagner - 2001
1	Vulnerabilities and Exposures, version 20010918, The Mitre Corporation, 2001; http://cve.mitre.org (current - Common - 2001
1	Flexible Policy-Directed Code Safety,” IEEE Symp. Security and Privacy - Evans, Twyman - 1999
1	Shankar et al., “Detecting Format String Vulnerabilities with Type Qualifiers - unknown authors - 2001
1	Orcero, “The Code Analyzer LCLint - Santo - 2000
1	Static Checking of C programs with LCLint,” Linux Gazette - Pramode, Gopakumar
1	is a PhD student in University of Virginia’s Department of Computer Science, where he works on lightweight static analysis with a focus on security. He has a BS in computer science from the College of William and Mary in Williamsburg, Virginia, and an MCS - Larochelle