基于静态分析技术的源代码安全检测模型

摘要
介绍了当前主流的静态代码分析技术,在分析讨论其优缺点的基础上提出了一种新的静态代码检测模型.该模型结合了当前成熟的静态分析技术,并借鉴了编译器中数据流和控制流分析的思想,获取上下文关联的数据信息,从而更加准确地分析代码中存在的安全问题.
作者
梁婕张淼徐国爱杨义先 LIANG Jie ZHANG Miao XU Guo-ai YANG Yi-xian
作者单位
北京邮电大学,网络与交换技术国家重点实验室信息安全中心,北京,100876
刊期
2008年9期 ISTIC PKU
关键词
数据流分析控制流分析别名分析静态代码分析源代码

参考文献

[1] CHESS B;McGRAW G. Static analysis for security. Security & Privacy Magazine, 2004,06
[2] AMTOFT T;BANERJEE A. Information flow analysis in logical form,[Technical Report CIS TR 2004-3]. Kansas State University, 2004
[3] VIEGA J;BLOCH J T;KOHNO T. ITS4:a static vulnerability scanner for C and CI-I-code. 2000
[4] CHEN Hao;WAGNER D. MOPS:an infrastructure for examining security properties of software. New York:ACM, 2002
[5] BERGER M;HONDA K;YOSHIDA N. A logical analysis of aliasing for higher-order imperative functions. 2005
[6] SABELFELD A;MYERS A C. Language-based information-flow security. IEEE Journal on Selected Areas in Communications, 2003
[7] YONG S H;HORWITZ S. Pointer-range analysis. Verona,Italy, 2004
[8] SUN Qi;BANERJEE A;NAUMANN D A. Modular and constraintbased information flow inference for an object-oriented language. Verona,Italy, 2004
[9] FLANAGAN C;FREUND S N. Type inference against races. Verona,Italy, 2004
[10] McGRAW G. Software security:building security. Addison-Wesley Professional, 2006
[11] WAGNER D;FOSTER J S;BREWER E A. A first step towards automated detection of buffer overrun vulnerabilities. San Diego,California,USA, 2000

查看更多︾

相似文献 查看更多>>