String Analysis for Software Verification and Security

Tevfik Bultan

ISBN 10: 3319886371 / ISBN 13: 9783319886374

Published by Springer International Publishing Jun 2019, 2019

About this Item

This item is printed on demand - it takes 3-4 days longer - Neuware -This book discusses automated string-analysis techniques, focusing particularly on automata-basedstatic string analysis. It covers the following topics: automata-basesstring analysis, computing pre and post-conditions of basic stringoperations using automata, symbolic representation of automata, forwardand backward string analysis using symbolic automata representation,constraint-based string analysis, string constraint solvers, relational stringanalysis, vulnerability detection using string analysis, string abstractions,differential string analysis, and automated sanitization synthesis usingstring analysis. String manipulation is a crucial part of modern software systems; forexample, it is used extensively in input validation and sanitization and indynamic code and query generation. The goal of string-analysis techniques and this bookis to determine the set of values that string expressions can take duringprogram execution. String analysis can be used to solve many problems inmodern software systems that relate to string manipulation, such as: (1)Identifying security vulnerabilities by checking if a security sensitivefunction can receive an input string that contains an exploit; (2) Identifyingpossible behaviors of a program by identifying possible values fordynamically generated code; (3) Identifying html generation errors bycomputing the html code generated by web applications; (4) Identifyingthe set of queries that are sent to back-end database by analyzing the codethat generates the SQL queries; (5) Patching input validation andsanitization functions by automatically synthesizing repairs illustrated in this book. Like many other program-analysis problems, it is not possible to solve the stringanalysis problem precisely (i.e., it is not possible to precisely determine theset of string values that can reach a program point). However, one cancompute over- or under-approximations of possible string values. If theapproximations are precise enough, they can enable developers todemonstrate existence or absence of bugs in string manipulating code.String analysis has been an active research area in the last decade,resulting in a wide variety of string-analysis techniques. This book will primarily target researchers and professionals working in computer security,software verification, formal methods, software engineering and program analysis. Advancedlevel students or instructors teaching or studying courses in computer security, software verification or program analysis willfind this book useful as a secondary text. 184 pp. Englisch.

Seller Inventory # 9783319886374

Bibliographic Details

• Title: String Analysis for Software Verification and Security
• Publisher: Springer International Publishing Jun 2019
• Publication Date: 2019
• Language: English
• ISBN 10: 3319886371
• ISBN 13: 9783319886374
• Binding: Taschenbuch
• Condition: Neu

About this title

Synopsis

This is the first existing book focusing on string analysis

Discusses how string analysis techniques work and how they can be applied to vulnerability detection in modern software applications

This book can be used as a textbook for a course on string analysis, or as a supplementary book for a course on vulnerability detection