www.icact.org

Member Login

TACT Journal Homepage

Call for Paper

Committee

Find My Paper

Author Homepage

Statistics & History

Welcome Message

Paper Procedure

FAQ

Paper Archives

Outstanding Papers

Program & Proceedings

Presentation Platform

Hotel & Travel Info

Photo Gallery

Scheduler Login

Seminar

Archives Login

Sponsors

Virual Oral Question and Answer


IEEE/ICACT20210212 Question.2 Questioner: nguyen@dsp.cse.kyutech.ac.jp 2021-02-09 오후 4:13:02	IEEE/ICACT20210212 Answer.2 Answer by Auhor hjcho1@korea.ac.kr 2021-02-09 오후 4:13:02
It's an interesting topic. However, I confuse about the conclusion that there is no need to determine whether an integer overflow is a true positive or false positive. But this determination is necessary to evaluate the warning. If there is only a need to fix the code, is it enough to avoid all cases of the attack?	Thank you for your question. Static analysis tool users view alarms and distinguish between true and false positives for many reasons. The tool may have made a mistake, or the properties they want to check may be different. However, it takes a lot of effort and time to judge true and false positives. We experimented with the integer overflow that occurred in the static analysis tool. Many papers evaluate the tool's performance and alarm, but we argue that it is unnecessary for integer overflows. We don't think all attack cases can be avoided by simply modifying the code. However, we believe developers can reduce the possible attack vectors and make the software more reliable and secure.

Select Voice