Merlin

摘要: The last several years have seen a proliferation of static and runtime analysis tools for finding security violations that are caused by explicit information flow in programs. Much this interest has been the increase number vulnerabilities such as cross-site scripting SQL injection. In fact, these commonly found Web applications now outnumber buffer overruns common type-unsafe languages C C++. Tools checking require specification to operate. most cases task providing is delegated user. Moreover, efficacy only good specification. Unfortunately, writing comprehensive presents major challenge: parts easy miss, leading missed vulnerabilities; similarly, incorrect specifications may lead false positives.This paper proposes Merlin, new approach automatically inferring from program code. Such greatly reduce manual labor, enhance quality results, while using check flow. Beginning with data propagation graph, which represents interprocedural program, Merlin aims infer an models paths graph probabilistic constraints. A naive modeling requires exponential constraints, one per path graph. For scalability, we approximate constraints on chosen triples nodes, resulting cubic We characterize approximation abstraction, theory refinement developed McIver Morgan. solve system factor graphs, well-known structure performing inference.We experimentally validate applying it 10 large business-critical analyzed CAT.NET, state-of-the-art tool .NET. find total 167 confirmed specifications, result 322 additional across benchmarks. More accurate also positive rate: our experiments, Merlin-inferred 13 positives being removed; constitutes 15% reduction CAT.NET rate final after experiments drops under 1%.