1,720,967 research outputs found
A Lightweight Security Analyzer inside GCC
No full textThis paper describes the design and implementation of a lightweight static security analyzer that exploits the compilation process of the gcc compiler. The tool is aimed at giving to programmers useful and precise hints for improving the security of the developed software, while also detecting format string vulnerabilities, buffer overflows, and subtle vulnerabilities due to incorrect arithmetic and conversion on integers. The experimented technique is a combination of the taint analysis concept and of a value range propagation algorithm. The experimental results obtained by analyzing some real-world security critical programs show that the tool is only slightly heavier than pure compilation, and that it is able to detect known vulnerabilities, as well as unknown ones. Moreover, even if false positives are given, many of the warnings that do not correspond to vulnerabilities are indeed instances of unsafe programming practices, which can be avoided by applying a defensive programming style. Then, the tool can be profitably used during development, as a means that facilitates such coding practic
Beyond Transformers: fault type detection in maintenance tickets with Kernel Methods, Boost Decision Trees and Neural Networks
Full text linkThe proper handling of customer tickets and maintenance requests is pivotal for enterprises as it directly impacts customer satisfaction.
The ability to rapidly and efficiently react and solve reported issues is in fact a key factor from the customers' perspective, resulting in positive feedback for the company, leading to higher economic and brand-image revenues.
The automatic detection of failures from maintenance tickets and support requests can grant faster and more efficient reactions to customers' equipment failures as well as reduced maintenance costs.
The analysis of support and maintenance requests is a well-known problem in Natural Language Processing (NLP).
State-of-the-art solutions in this field rely on Transformers models, pre-trained on large text corpora, and then fine-tuned on the specific downstream task.
However, due to their intrinsic nature, support requests are highly domain-specific and usually similar to short telegraph messages, where the focus is typically encapsulated in short sequences rather than in long dependencies.
Hence, ad-hoc methods for pattern recognition might provide comparable performances with respect to Transformers.
In this work, two alternative approaches are proposed, based on: Kernel methods in conjunction with Boost Decision Trees (SpectrumBoost), and Neural Networks for Multiple Representation Learning (DeepMRL).
These models have been tested and compared against state-of-the-art models on a real-world set of 131305 maintenance tickets in the Italian language, suggesting that the proposed models outperform Transformers both in the prediction accuracy and in the time and computational resources required for their training
Comparing Lexical Analysis Tools for Buffer Overflow Detection in Network Software
No full textMany of the bugs in distributed software modules are security vulnerabilities, the most common and also the most exploited of which are buffer overflows and they typically arise in programs written in the C language. This paper, focusing on static analysis tools for detecting buffer overflows in C programs, presents a methodology for experimentally evaluating and comparing the main objective features of such tools. The proposed method is based on testing all the tools on a common set of publicly available, open source software packages, and makes use of specific metrics defined to evaluate the main tool features. In particular, the evaluation aims at quantifying how close the tool is to a complete and sound tool. Our approach has been applied for an initial evaluation of the class of static analysis tools that are based on lexical analysis, using as test cases three well known network software packages. The results obtained, illustrated and commented on in this paper, offer some interesting indication
Vulnerability Modelling for the Analysis of Network Attacks
No full textIn order to perform a successful attack on a network, an intruder must know various penetration techniques, also known as exploits. In general, an exploit can be successful only if some pre-conditions are true. Such conditions may involve the presence of vulnerable programs and/or specific software configurations, as well as certain attacker privileges on hosts and network reachability. When an exploit has success, it usually induces a new set of conditions within the network (post-conditions), such as new attacker privileges, and increased connectivity. Therefore, a network attack can be made of a series of exploits that gradually increase the attacker "power" on the network, until some final goal has been reached or the whole network has been compromised. Reaching such a goal is possible because of dependencies among exploits in terms of pre- and post-conditions. This paper describes how the OVAL language, originally aimed at describing how to check for the existence of vulnerabilities on hosts, can be enhanced to allow automatic reasoning for precisely determining the possible chains of exploits that an attacker could use to compromise the hosts in the network. Moreover, the paper shows how the description of vulnerabilities can be enriched to allow performing risk analysis, so as to determine the impact of attackers on the network, as well as the likelihood of attack
The Java SPI Framework for Security Protocol Implementation
Full text linkThis paper presents JavaSPI, a "model-driven" development framework that allows the user to reliably develop security protocol implementations in Java, starting from abstract models that can be verified formally. The main novelty of this approach stands in the use of Java as both a modeling language and the implementation language. By using the SSL handshake protocol as a reference example, this paper illustrates the JavaSPI framework
- …
