서브메뉴
검색
Detecting Bugs and Security Issues by Identifying Developers' Blind Spots
Detecting Bugs and Security Issues by Identifying Developers' Blind Spots
상세정보
- 자료유형
- 학위논문 서양
- 최종처리일시
- 20250211151350
- ISBN
- 9798384067955
- DDC
- 004
- 저자명
- Zhong, Li.
- 서명/저자
- Detecting Bugs and Security Issues by Identifying Developers Blind Spots
- 발행사항
- [Sl] : University of California, San Diego, 2024
- 발행사항
- Ann Arbor : ProQuest Dissertations & Theses, 2024
- 형태사항
- 101 p
- 주기사항
- Source: Dissertations Abstracts International, Volume: 86-03, Section: B.
- 주기사항
- Advisor: Zhou, Yuanyuan.
- 학위논문주기
- Thesis (Ph.D.)--University of California, San Diego, 2024.
- 초록/해제
- 요약Bugs and security issues are primary concerns for software developers. Existing research has continuously focused on addressing these problems. However, the evolution of software engineering leads to increasingly complex software systems that are more susceptible to bugs. The rise of third-party services, cross-vendor libraries, and collaborative development introduces significant challenges for developers, making it difficult for them to have a comprehensive understanding of the entire codebase. Under the pressure of agile development timelines, developers often work with incomplete knowledge, leading to potential blind spots in software development. These blind spots can result in developers being unaware of certain constraints or security implications imposed by other components or authors, causing serious issues in access control, memory management, I/O operations, and business logic.This dissertation investigates two aspects of these challenges. The first aspect focuses on cross-authorship blind spots. This part of the study identifies a specific pattern of bug-proneness, namely cross-authorship unused definitions. To address this, we introduce syntactic and semantic patterns that help identify such issues while filtering out false positives. Additionally, to accommodate the time pressures faced by developers, we use a code familiarity model to prioritize bug validation. Our implementation, named VALUECHECK, has been evaluated on large-scale systems including Linux, MySQL, OpenSSL, and NFS-ganesha, successfully detecting 210 unknown bugs, with 154 confirmed. In comparisons with the state-of-the-art tools like Infer and Coverity, VALUECHECK demonstrates greater effectiveness and lower false positive rates.The second part studies cross-component blind spots. It focuses on blind spots in web applications with a client-server architecture, where client-side code is exposed. Relying solely on client-side security checks for authorization, identity verification, and user input validation is insufficient due to potential user manipulation. To address this, we propose a novel technique that enhances existing methods by altering client-side code to assess server-side security. This approach improves testing efficiency and detects complex vulnerabilities related to business logic, token-based defenses, and data preprocessing. Our testing tool, FENCEHOPPER, identified 48 vulnerabilities in the top 300 websites from the Tranco dataset, including critical access control flaws affecting over 20 million user accounts.
- 일반주제명
- Computer science
- 일반주제명
- Computer engineering
- 키워드
- Business logic
- 기타저자
- University of California, San Diego Computer Science and Engineering
- 기본자료저록
- Dissertations Abstracts International. 86-03B.
- 전자적 위치 및 접속
- 로그인 후 원문을 볼 수 있습니다.
MARC
008250123s2024 us c eng d■001000017161391
■00520250211151350
■006m o d
■007cr#unu||||||||
■020 ▼a9798384067955
■035 ▼a(MiAaPQ)AAI31243091
■040 ▼aMiAaPQ▼cMiAaPQ
■0820 ▼a004
■1001 ▼aZhong, Li.
■24510▼aDetecting Bugs and Security Issues by Identifying Developers' Blind Spots
■260 ▼a[Sl]▼bUniversity of California, San Diego▼c2024
■260 1▼aAnn Arbor▼bProQuest Dissertations & Theses▼c2024
■300 ▼a101 p
■500 ▼aSource: Dissertations Abstracts International, Volume: 86-03, Section: B.
■500 ▼aAdvisor: Zhou, Yuanyuan.
■5021 ▼aThesis (Ph.D.)--University of California, San Diego, 2024.
■520 ▼aBugs and security issues are primary concerns for software developers. Existing research has continuously focused on addressing these problems. However, the evolution of software engineering leads to increasingly complex software systems that are more susceptible to bugs. The rise of third-party services, cross-vendor libraries, and collaborative development introduces significant challenges for developers, making it difficult for them to have a comprehensive understanding of the entire codebase. Under the pressure of agile development timelines, developers often work with incomplete knowledge, leading to potential blind spots in software development. These blind spots can result in developers being unaware of certain constraints or security implications imposed by other components or authors, causing serious issues in access control, memory management, I/O operations, and business logic.This dissertation investigates two aspects of these challenges. The first aspect focuses on cross-authorship blind spots. This part of the study identifies a specific pattern of bug-proneness, namely cross-authorship unused definitions. To address this, we introduce syntactic and semantic patterns that help identify such issues while filtering out false positives. Additionally, to accommodate the time pressures faced by developers, we use a code familiarity model to prioritize bug validation. Our implementation, named VALUECHECK, has been evaluated on large-scale systems including Linux, MySQL, OpenSSL, and NFS-ganesha, successfully detecting 210 unknown bugs, with 154 confirmed. In comparisons with the state-of-the-art tools like Infer and Coverity, VALUECHECK demonstrates greater effectiveness and lower false positive rates.The second part studies cross-component blind spots. It focuses on blind spots in web applications with a client-server architecture, where client-side code is exposed. Relying solely on client-side security checks for authorization, identity verification, and user input validation is insufficient due to potential user manipulation. To address this, we propose a novel technique that enhances existing methods by altering client-side code to assess server-side security. This approach improves testing efficiency and detects complex vulnerabilities related to business logic, token-based defenses, and data preprocessing. Our testing tool, FENCEHOPPER, identified 48 vulnerabilities in the top 300 websites from the Tranco dataset, including critical access control flaws affecting over 20 million user accounts.
■590 ▼aSchool code: 0033.
■650 4▼aComputer science
■650 4▼aComputer engineering
■653 ▼aSoftware developers
■653 ▼aBusiness logic
■653 ▼aAgile development
■653 ▼aMemory management
■653 ▼aSoftware engineering
■690 ▼a0984
■690 ▼a0464
■71020▼aUniversity of California, San Diego▼bComputer Science and Engineering.
■7730 ▼tDissertations Abstracts International▼g86-03B.
■790 ▼a0033
■791 ▼aPh.D.
■792 ▼a2024
■793 ▼aEnglish
■85640▼uhttp://www.riss.kr/pdu/ddodLink.do?id=T17161391▼nKERIS▼z이 자료의 원문은 한국교육학술정보원에서 제공합니다.
