Static Vulnerabilities Detection Based on Extended Vulnerability State Machine Model

A static vulnerability detection method based on an extended vulnerability state machine is proposed in this paper. In this method, the state space of state machine model is extended. The security state of a variable can be identified by a property set that may consist of multiple security-related properties rather than a single property. As results, fine-grained state transition is provided to support accurate recognition of program security-related behaviors. Specially, the recognition of validation checking is introduced to reduce false positives. Besides, a systematic discrimination mechanism for tainted data is constructed to prevent false negatives result from neglecting tainted data sources. The experimental results of a prototype system show that this method can effectively detect vulnerabilities in software systems with obviously lower false positive than existing methods, and avoid some serious false negative.