 ICACT20210212 Slide.01
[Big Slide]
|
Chrome  Click!! |
 |
Hello, I am HongJun Choi, a master's course in the School of Cybersecurity, Korea University. My current research interests are in static analysis, secure software engineering, formal methods. My presentation topic is 'Is a False Positive really False Positive?.' To solve the problem of determining whether alarms generated by static analysis tools are a true positive or false, I analyze and explain integer overflow by dividing it into 4 cases in terms of reliability and security. |
| ICACT20210212 Slide.02
[Big Slide]
|
Chrome Click!! |
 |
As software spreads to various industries, software dependence and complexity increase, and the probability of software defects is also increasing. Among the possible defects, we deal with integer overflow. First, I will introduce software disasters for integer overflow caused by reliability and security issues. Second, I explain the existing research on the relationship between reliability and security and show the definition of reliability and security that we use. Third, I will say the definition of that true and false positive in the static analysis based on the definition of reliability and security. Also, I will introduce the four cases of potential integer overflow using the binary search case and show the results of static analysis. And I will explain the result of static analysis for the CWE-190 test case among Juliet Test Suite provided by the National Institute of Standards and Technology. Finally, I will give you our conclusion. |
| ICACT20210212 Slide.03
[Big Slide]
|
Chrome Click!! |
 |
People make mistakes in the process of building software, resulting in software bugs. Here are two examples of software disasters caused by an integer overflow in 2015. Boeing Dreamliner must reboot every 248 days to continue flying. Otherwise, an integer overflow could occur, causing the generator control unit to enter safe mode and lose all alternating current power. It is a reliability issue because an integer overflow occurred by input values defined in the specification. Another example is an integer overflow vulnerability that occurred in libstagefright, which Android uses to run the format such as MP4 files. When the sum of the chunk's size and size exceeds the maximum value that 32bit can express, memory corruption occurs and allows hackers to insert the desired malicious code. It is a security issue because an integer overflow occurred by the undefined chunk size. |
| ICACT20210212 Slide.04
[Big Slide]
|
Chrome Click!! |
 |
This paper author describes reliability and security as follows. Also, it shows a relationship between reliability and security using the availability. He says that availability is only authorized personnel who can access data on the computer, and hardware and software are reliable. He says about this notation: Without reliability, availability is not met. It leads to a lack of security. When reliability is met, and security is not met, availability is met if there are no malicious attacker attacks. And it argues that the reliability is satisfied, but the availability can be affected by malicious action. |
| ICACT20210212 Slide.05
[Big Slide]
|
Chrome Click!! |
 |
This paper author says that reliability and security have many things in common, so many studies compare the two properties. Some researchers say that security is part of reliability, while others say the opposite. If an attacker succeeds in attacking by using defects caused by lack of reliability, it becomes a vulnerability. Thus, they argue that security is part of reliability because weaknesses can occur if the software is unreliable. |
| ICACT20210212 Slide.06
[Big Slide]
|
Chrome Click!! |
 |
The Sommerville software engineering book defines reliability and security as follows: Reliability is the ability to serve as specified. Security is the ability to protect systems against deliberate or accidental intrusions. We use its definitions in our study. |
| ICACT20210212 Slide.07
[Big Slide]
|
Chrome Click!! |
 |
We define true positive and false positive in the static analysis as follows using Sommerville's reliability and security. Since reliability is the ability to provide services as specified, only inputs defined in the specification are considered within the reliability range, and other inputs are considered within the security range. When an input defined in the specification enters the program, if the static analysis tool generates an alarm for the statement, it is a true positive in terms of reliability and a false positive in terms of security. When an undefined input in the specification enters the program, true positive and false positive is the opposite of the previous result in terms of reliability and security. |
| ICACT20210212 Slide.08
[Big Slide]
|
Chrome Click!! |
 |
We discuss a potential integer overflow in terms of reliability and security. To discuss this, we use a binary search as an example. To proceed with the experiment and analysis, we made four cases as follows. Case 1 is finding the natural number N in an array sorted from 1 to 100. Also, Case 2 finds the natural number N in an array sorted from 1 to INT_MAX-1. Case 3 finds the natural number N in an array sorted from 1 to 100 and protects itself against deliberate or accidental intrusion. And Case 4 finds the natural number N in an array sorted from 1 to INT_MAX and protects itself against deliberate or accidental intrusion. |
| ICACT20210212 Slide.09
[Big Slide]
|
Chrome Click!! |
 |
This figure is a code implemented according to the requirements of Cases 1 and 2, and an integer overflow occurs. The two cases' requirements are different, but the developer assumes that a program user enters the input defined in the specification, so they write the same code for both cases. If this code is the code that Case 1 is implemented, it satisfies reliability, but not security. Case 1 requirement is that finding N out of a number from 1 to 100. Then, first and last within the defined input range have a value from 1 to 100. However, first and last within the undefined input range can also be received from the binary search function. In the code implemented according to Case 1, integer overflow will not occur due to first and last within the defined input range. Nevertheless, integer overflow will occur when first and last within the undefined input range are entered. If this code is the code that Case 2 is implemented, it does not satisfy reliability and security. According to the Case 2 requirement, the first and last within the defined input range have numbers from 1 to INT_MAX-1. The first and last within the undefined input range are INT_MAX. In this case, an integer overflow will occur regardless of whether it is defined as an input or not. Since both cases 1 and 2 do not satisfy security, it allows that deliberate or accidental intrusion. The difference is whether or not the reliability is satisfied. Suppose a reliability-oriented group runs static analysis tools for a code implemented according to Case 1, and an integer overflow alarm occurs. In that case, they will judge that it is a false positive. However, suppose the same group runs a static analysis tool for a code implemented according to Case 2, and an integer overflow alarm occurs. In that case, they will determine that it is a true positive. And suppose a security-oriented group runs a static analysis tool for codes implemented according to Case 1 and Case 2, and an integer overflow alarm occurs. In that case, they will determine that it is a true positive. |
| ICACT20210212 Slide.10
[Big Slide]
|
Chrome Click!! |
 |
This figure is the code implemented according to the requirements of Case 3. Case 3 satisfies both reliability and security. According to Case 3 requirements, the first and last within the defined input range have numbers from 1 to 100. And since deliberate or accidental intrusion is impossible, they cannot have a value other than 1 to 100. Therefore, integer overflow will not occur. If an alarm occurs by executing a static analysis tool for the code in Figure 2, this alarm is unconditionally false positive. |
| ICACT20210212 Slide.11
[Big Slide]
|
Chrome Click!! |
 |
This figure is the code implemented according to the requirements of Case 4. Case 4 does not satisfy reliability but security. According to Case 4 requirements, first and last within the defined input range have numbers between 1 and INT_MAX. Also, since deliberate or accidental intrusion is impossible, they cannot have values other than 1 to INT_MAX. When first and last have a value greater than INT_MAX/2, an integer overflow will occur. Suppose an alarm occurs by executing a static analysis tool for this code. In that case, reliability-oriented groups will judge the alarm as true positive, and security-oriented groups will determine the alarm as false positive. |
| ICACT20210212 Slide.12
[Big Slide]
|
Chrome Click!! |
 |
We are able to synthesize the previous analysis results and display them as shown in this table. Case 1 satisfies the reliability but does not satisfy the security, resulting in an integer overflow. Case 2 is not satisfied with both reliability and security, so integer overflow occurs. Case 3 satisfies not only reliability but also security, so integer overflow does not occur. Case 4 satisfies the security but does not satisfy the reliability, resulting in an integer overflow. |
| ICACT20210212 Slide.13
[Big Slide]
|
Chrome Click!! |
 |
This figure is the static analysis result for binary search code implemented according to Case 1, 2. The Overflow checker of a static analysis tool reports an overflow in line 7 of the binary_search function. The problem here is that it takes a lot of time and effort to determine whether this alarm is a true or false positive. If this figure is the static analysis result of the code implemented according to Case 1, it is a false positive in terms of reliability. On the other hand, if this figure is the static analysis result of the code implemented according to Case 2, it is a true positive in terms of reliability. Even if the defined first and last have 100, a maximum value, based on Case 1, it is a false positive because overflow does not occur. |
| ICACT20210212 Slide.14
[Big Slide]
|
Chrome Click!! |
 |
This figure is the static analysis result for binary search code implemented according to case 3. In the circle graph, a Proven 100% means that there is no weakness. Since the code implemented according to Case 3 protects the system from deliberate or accidental intrusion, the first and last variables can only have numbers from 1 to 100. Therefore, there is no weakness in terms of reliability and security. |
| ICACT20210212 Slide.15
[Big Slide]
|
Chrome Click!! |
 |
This figure is the result of static analysis for binary search code implemented according to case 4. The overflow checker generates an alarm. The code implemented according to case 4 satisfies security but not reliability. When an alarm occurs, developers or test engineers analyze the code for that alarm and determine if it is the true positive or false positive. The developer or test engineer of the reliability-oriented group judges the result of this figure as true positive. The developer or test engineer of the security-oriented group determines the result of this figure as false positive. |
| ICACT20210212 Slide.16
[Big Slide]
|
Chrome Click!! |
 |
This figure shows whether the integer overflow caused after the static analysis is true or false positive. Integer overflows are divided into true or false positives depending on the input range defined in the specification and both properties. However, all integer overflow generated by static analysis tools is eventually a true positive weakness. The small input range means no integer overflow due to the calculation of defined input values. An example of this is the requirement of Case 1. A large input range means that integer overflow can occur due to the calculation of defined input values. An example of this is the requirement of Case 2. An input range of MAX means that the calculation of defined input values will cause an integer overflow, but undefined input values will not cause it. An example of this is the requirement of Case 4. The code corresponding to the second column satisfies reliability because it does not cause integer overflow by defined input. However, an integer overflow occurs in terms of security. We confirmed through the static analysis result for binary search code implemented according to Cases 1 and 2 that an integer overflow occurs in the code implemented according to Case 1. The code corresponding to the third column causes an integer overflow in terms of reliability and security. We also confirmed this through the static analysis result for binary search code implemented according to Cases 1 and 2. The code corresponding to the fourth column has an integer overflow in terms of reliability. We confirmed through the static analysis result for binary search code implemented according to Case 4 that an integer overflow occurs in the code implemented according to Case 4.In this figure, there are true positives and false positives in each column. Since there is at least one true positive when each column is combined, we conclude that all integer overflow generated by static analysis tools is a weakness. As a result, developers and test engineers do not need to differentiate between true or false positives for integer overflow caused by static analysis tools. |
| ICACT20210212 Slide.17
[Big Slide]
|
Chrome Click!! |
 |
We also performed static analysis for false-positive example that CWE-190: Integer Overflow test case. The left figure is the code of lines 46 to 53 of the CWE190_Integer_Overflow__char_max_square_65a.c file. This code calls the function of the right figure with parameter 2. The right figure is the code of lines 38 to 45 of the CWE190_Integer_Overflow__char_max_square_65b.c file. The developer wrote the code of the two files, and the result will be 4. |
| ICACT20210212 Slide.18
[Big Slide]
|
Chrome Click!! |
 |
This figure is the static analysis result for the CWE-190 example code. As a result of analyzing the preceding code flow, the result is 4. Anyone can expect that integer overflow will not occur. However, the overflow checker says that there is an integer overflow in line 42. It is a false positive in terms of reliability. We did a detailed analysis to determine why the static analysis tool said an integer overflow exists in this line. The static analysis tool we used created a main function that directly calls the goodG2BSink function and inserts random argument values. The range of values that the data variable can have is -128 to 127. So, the range of values that the result variable has is 0 to 16384. Therefore, This is an integer overflow caused by the lack of security. |
| ICACT20210212 Slide.19
[Big Slide]
|
Chrome Click!! |
 |
This figure is the correct code for preventing the integer overflow from the original code. Since the result of multiplying two data must be -128 or more and 127 or less, data must have a value greater than -12 and less than 12. So, we added a conditional statement that handles exceptions for the data variable. |
| ICACT20210212 Slide.20
[Big Slide]
|
Chrome Click!! |
 |
We performed a static analysis for correct goodG2BSink using a static analysis tool. As a result, we confirmed that Overflow, Static Analysis Result for CWE-190 Example Code changed from orange to green, which proved no weakness, as shown in this figure. |
| ICACT20210212 Slide.21
[Big Slide]
|
Chrome Click!! |
 |
The importance of software is increasing in countries, societies, and lives. Several agencies have defined the concept of software assurance, which includes the definitions of reliability and security. Now, software engineers should not look at software quality and security assurance separately.
In this paper, we analyze the binary search program and CWE-190 test case example and performed the static analysis. As a result, we conclude that all integer overflows generated by static analysis tools are true positives. It solves the difficulties of distinguishing true positive and false positive, which are the limitations of static analysis. After performing static analysis, the developer should modify the code to satisfy reliability and security.
In future research, we will expand our study to analyze all Juliet Test Suite for C/C++. We will propose that the performance indicators for comparing static analysis tools should be changed by analyzing false positives in the static analysis results. |
| ICACT20210212 Slide.22
[Big Slide]
|
Chrome Click!! |
 |
If you have any questions about the presentation, please contact me. Thank you for listening to my presentation. |
