Description
Software vulnerabilities, especially those that are memory-based, are critical in modern
systems. The conventional vulnerability detection tools use either static or dynamic analysis,
but each method has its limitations regarding precisely identifying the memory interactions.
This thesis presents a new approach that uses points-to information from the dynamic analysis
to improve the accuracy of graph-based vulnerability detection of source code. A custom
Pintool was developed to extract dynamic points-to information. The extracted data was
then represented in a graph-based form of the source code. Furthermore, the extracted
dynamic information will be employed to enhance the quality of node embeddings in the
Graph Neural Network (GNN). By incorporating runtime memory interactions, the GNN
learns more informative representations of program behavior, resulting in more accurate
detection of software vulnerabilities. This thesis shows the feasibility of incorporating pointsto
information into a graph-based security analysis framework and thus using dynamic
techniques for vulnerability detection. The proposed methodology allows for better insights
into memory interactions, which are critical for identifying security weaknesses and improving
machine learning-based vulnerability detection.
|
Thesis topic in co-operation with the Fraunhofer Institute for Applied and Integrated Security AISEC, Garching