Research Of Data-driven Vulnerability Detection Technology

With the ripeness of computer technology and the application of internet in different fields,information security is becoming more and more important.Different kinds of software vulnerability may be used to cause different kinds of problems by computer virus and.Data-driven vulnerability is one of the most common vulnerabilities in all of the vulnerabilities.The number of data-driven vulnerability account for about 50% above of all the vulnerabilities according to the CERT reports at recent years.Data-driven vulnerability is usually found in the softwares which ared coded by C/C++.For the typical programming languages C/C++,the root cause of Data-driven vulnerability is that the C/C++ has a security flaw. For example,C/C++ don't check the array boundary and so on.Moreover,the security problems which are caused by data-driven vulnerability are usually ignored by programmers.Now the static detection gives the vulnerability report by using lexical analysis and syntax analysis which are based on complie method.However,the static detection now still has some flaws.Generally speaking,the detections have such flaws as follows:the test result will have the massive misinformations,to fail to report, the test result rate of accuracy will be low; it will consume the system resources, the examination efficiency is quite low.In response to this situation,an algorithm based on semantic analysis to detect data-driven vulnerability automatically is presented. The algorithm defines lexical elements and syntax elements,on the base of the lexical elements and the syntax elements, through the buffer searches in advance, interval operation and improvement wagner algorithm and so on methods, it has realized to vulnerability semantic level examination. Compared to the traditional static detection which use complie method,the new static detection make a more accurate detection for data-driven vulnerability,and the detection system improves efficiency. In the end,a static detection system is designed and complied,and is proved valid by experiment.