Automated Vulnerability Detection via Symbolic Execution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for analyzing software vulnerabilities struggle to balance computation time, accuracy, and human comprehensibility, making it difficult to determine if software contains malware and ensure it behaves correctly, especially in edge cases.
Innovation Solution
A configurable tool that disassembles programs, generates function call trees, transforms statements into logical equations, and uses Dijkstra's weakest preconditions to determine preconditions that guarantee desired post-conditions, employing automated solvers to identify and exploit vulnerabilities such as buffer overflows and indirect jumps.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional vulnerability analysis methods are used, then human comprehensibility is improved, but computation time and accuracy are insufficient
Solution Approach 1:
The patent replaces manual vulnerability analysis with an automated symbolic execution system that uses computer-generated test cases and formal verification methods. The system automatically transforms program code into logical representations, executes them symbolically to explore all possible execution paths, and uses theorem provers to verify security properties, thereby achieving high accuracy without requiring human analysts to manually trace every possibility.
Solution Approach 2:
The system changes the fundamental parameters of analysis by transitioning from static code review to dynamic symbolic execution. It transforms program code into intermediate representations, systematically varies input parameters across all possible values, and evaluates security properties for each execution path, enabling comprehensive coverage of edge cases that would be time-consuming for manual analysis.
2Reliability
If comprehensive program analysis is performed to detect all vulnerabilities, then detection accuracy is improved, but analysis time increases significantly
Solution Approach 1:
The patent segments the vulnerability analysis process into distinct phases: parsing program code into intermediate representations, generating symbolic execution paths, executing them with specific inputs, and verifying security properties. This segmentation allows each phase to be optimized independently and enables parallel processing of multiple analysis tasks, improving overall productivity while maintaining comprehensive coverage.
Solution Approach 2:
The system performs preliminary actions by pre-processing program code into standardized intermediate representations and pre-defining security properties to be verified. It also pre-generates test cases and execution paths before actual vulnerability detection begins, so that when analysis starts, the framework is already prepared to systematically explore all possibilities without requiring time-consuming on-the-fly transformations.
3Productivity
If automated analysis tools are used to improve speed, then productivity is improved, but human comprehension of results deteriorates
Solution Approach 1:
The patent implements feedback mechanisms that automatically interpret and explain analysis results in terms understandable to human analysts. The system provides detailed reports showing which security properties were verified, which execution paths were explored, and which vulnerabilities were detected, along with the specific inputs that triggered each finding. This feedback loop allows automated high-throughput analysis while maintaining transparent, interpretable results that human operators can readily comprehend and act upon.
Data Source
AI summary
A method executable via operation of configured processing circuitry to identify vulnerabilities in program code may include receiving a program and employing a disassembler to disassemble the program, generating a function call tree for the program based on disassembly of the program, receiving an indication of a post condition for which analysis of the program is desired, transforming program statements into logical equations, simplifying the logical equations, propagating post conditions backwards via Dijkstra's weakest precondition variant, analyzing aliases and processing loops to generate a precondition, and using an automated solver to determine whether the precondition is realizable and, if so, providing program inputs required to realize the precondition.