An Optimized Static Propositional Function Model to Detect Software Vulnerability

Abstract

Due to the lack of appropriate theory to accurately characterize vulnerabilities, the current static detection technologies have two key challenges, i.e., limited applicability, and the problem of state space explosion. In this paper, we put forward a static detection model based on the proposition function. Furthermore, a new program intermediate representation called Vulnerability Executable Path Set (VEPS) is proposed to optimize our model which compresses the program state space distinctly. In addition, in order to confirm the reliability of the static detection model, we conduct three terms of contrast experiments to estimate the results with the vulnerability disclosed by NIST. The results obtained from extensive experiments show that the proposed model effectively detects more Wireshark bugs than NIST, and reveals a higher detection efficiency than FindBugs.