自动程序修复中的安全隐患场景及解决方案

doi:10.19665/j.issn1001-2400.2019.06.021

Abstract

Abstract:

To improve the quality of the Automatic Program Repair (APR) method, this research points out two scenarios, namely tainted patch sources and error test suites, which may lead to security risks in the APR-based software defect fix. Moreover, the research proposes the corresponding solutions, namely the patch verification schema and the test suite verification schema, respectively. Experimental results demonstrate that the patch verification schema can enable the APR to obtain a more secure patch, and that the test suite verification scheme can accurately locate the error test cases in the test suite with a false positive rate of 7.20%.

Key words: automatic program repair, static analysis, test suite, software security

CLC Number:

TP309

HUANG Yuming,MA Jianfeng,LIU Zhiquan,WEI Kaimin,FENG Bingwen. Security risk scenarios and solutions in automatic program repair[J].Journal of Xidian University, 2019, 46(6): 147-154.

Figures/Tables 12

References 16

[1]	李斌, 贺也平, 马恒太 . 程序自动修复: 关键问题及技术[J]. 软件学报, 2019,30(2):244-265.
	LI Bin, HE Yeping, MA Hengtai . Automatic Program Repair: Key Problems and Technologies[J]. Journal of Software, 2019,30(2):244-265.
[2]	MONPERRUS M . Automatic Software Repair: a Bibliography[J]. ACM Computing Surveys, 2018,51(1):17.
[3]	HARMAN M, MANSOURI S A, ZHANG Y . Search-based Software Engineering: Trends, Techniques and Applications[J]. ACM Computing Surveys, 2012,45(1):11.
[4]	LE GOUES C, NGUYEN T V, FORREST S , et al. GenProg: a Generic Method for Automatic Software Repair[J]. IEEE Transactions on Software Engineering, 2012,38(1):54-72. doi: 10.1109/TSE.2011.104
[5]	XIONG Y, WANG J, YAN R , et al. Precise Condition Synconfproc for Program Repair[C]//Proceedings of the 2017 IEEE/ACM 39th International Conference on Software Engineering. Piscataway: IEEE, 2017: 416-426.
[6]	GUPTA R, PAL S, KANADE A , et al. Deepfix: Fixing Common C Language Errors by Deep Learning[C]//Proceedings of the 2017 31st AAAI Conference on Artificial Intelligence Palo Alto: AAAI Press, 2017: 1345-1351.
[7]	KIM D, NAM J, SONG J , et al. Automatic Patch Generation Learned from Human-written Patches[C]//Proceedings of the 2013 International Conference on Software Engineering. Washington: IEEE Computer Society, 2013: 802-811.
[8]	LE X B D, THUNG F, LO D , et al. Overfitting in Semantics-based Automated Program Repair[J]. Empirical Software Engineering, 2018,23(5):3007-3033. doi: 10.1007/s10664-017-9577-2
[9]	XIN Q, REISS S P . Identifying Test-suite-overfitted Patches through Test Case Generation[C]//Proceedings of the 2017 26th ACM SIGSOFT International Symposium on Software Testing and Analysis. New York: ACM, 2017: 226-236.
[10]	KIM S, WOO S, LEE H , et al. VUDDY: a Scalable Approach for Vulnerable Code Clone Discovery[C]//Proceedings of the 2017 IEEE Symposium on Security and Privacy. Piscataway: IEEE, 2017: 595-614.
[11]	LAVOIE T, EILERS-SMITH M, MERLO E . Challenging Cloning Related Problems with GPU-based Algorithms[C]//Proceedings of the 2010 International Conference on Software Engineering. Washington: IEEE Computer Society, 2010: 25-32.
[12]	TU D, CHEN R, DU Z , et al. A Method of Log File Analysis for Test Oracle[C]//Proceedings of the 2009 International Conference on Scalable Computing and Communications - The 8th International Conference on Embedded Computing. Washington: IEEE Computer Society, 2009: 351-354.
[13]	MCCABE T J . A Complexity Measure[J]. IEEE Transactions on Software Engineering, 1976,2(4):308-320. doi: 10.1007/s11096-019-00957-6 pmid: 31865595
[14]	段钊, 刘锟龙 . 采用CPAChecker的动态程序验证[J]. 西安电子科技大学学报, 2019,46(1):33-38. doi: 10.1002/(sici)1097-4636(199907)46:1&lt;33::aid-jbm4&gt;3.0.co;2-k pmid: 10357133
	DUAN Zhao, LIU Kunlong . Dynamic Program Verification via a CPAChecker[J]. Journal of Xidian University, 2019,46(1):33-38. doi: 10.1002/(sici)1097-4636(199907)46:1&lt;33::aid-jbm4&gt;3.0.co;2-k pmid: 10357133
[15]	LATTNER C, ADVE V . LLVM: A Compilation Framework for Lifelong Program Analysis and Transformation[C]//Proceedings of the 2004 International Symposium on Code Generation and Optimization. Washington: IEEE Computer Society, 2004: 75-86.
[16]	JUST R, JALALI D, ERNST M D . Defects4J: a Database of Existing Faults to Enable Controlled Testing Studies for Java Programs[C]//Proceedings of the 2014 International Symposium on Software Testing and Analysis. New York: ACM, 2014: 437-440.

项目名称	缺陷数	测试用例数
Chart	26	2 205
Lang	65	2 245
Math	105	3 602
Time	27	4 130

项目名称	测试用例数	错误用例数	实际检出数	误报率/%
Chart	4 410	35	38	8.57
Lang	4 490	38	40	5.26
Math	7 204	57	61	7.02
Time	8 260	63	68	7.94

项目名称	添加GenProg前修复缺陷数	添加GenProg后修复缺陷数
Chart	0	0
Lang	0	0
Math	5	5
Time	0	0

项目	添加PAR前修复缺陷数	添加PAR后修复缺陷数
Chart	0	0
Lang	1	1
Math	3	3
Time	0	0

Security risk scenarios and solutions in automatic program repair

RichHTML

PDF (PC)

Like

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 12

References 16

Related Articles 4

Metrics

Comments

Recommended 10

[1]	HUANG Yuming,MA Jianfeng,LIU Zhiquan,FENG Bingwen,WEI Kaimin. Rule-based automatic program repair method [J]. Journal of Xidian University, 2020, 47(4): 117-123.
[2]	SU Zijian;LIANG Changhong;LI Long;ZHAI Huiqing. Improved quasi-static effective medium model of the electromagnetic band gap (EBG) high-impedance surface [J]. J4, 2015, 42(5): 92-97.
[3]	FAN Yesen;LI Tuanjie;MA Xiaofei;LI Zhengjun. Form-finding method of equal tension cable networks for space mesh antennas [J]. J4, 2015, 42(1): 49-55.
[4]	ZHANG Liyong；WANG Xianqing；CHEN Ping；DENG Fan；KONG Delan. Fast reverse searching method for covert channels identification [J]. J4, 2011, 38(3): 128-135.