Toward Automated Exploit Generation for Known Vulnerabilities in Open-Source Libraries

Created by W.Langdon from gp-bibliography.bib Revision:1.7642

@InProceedings{Iannone:2021:ICPC,

• author = "Emanuele Iannone and Dario {Di Nucci} and Antonino Sabetta and Andrea {De Lucia}",
• title = "Toward Automated Exploit Generation for Known Vulnerabilities in Open-Source Libraries",
• booktitle = "2021 IEEE/ACM 29th International Conference on Program Comprehension (ICPC)",
• year = "2021",
• pages = "396--400",
• publisher = "IEEE",
• keywords = "genetic algorithms, genetic programming, SBSE, SIEGE, EVOSUITE, Exploit Generation, Security Testing, Software Vulnerabilities",
• DOI = "doi:10.1109/ICPC52881.2021.00046",
• size = "5 pages",
• abstract = "Modern software applications, including commercial ones, extensively use Open-Source Software (OSS) components,accounting for 90 percent of software products on the market. This has serious security implications, mainly because developers rely on non-updated versions of libraries affected by software vulnerabilities. Several tools have been developed to help developers detect these vulnerable libraries and assess and mitigate their impact. The most advanced tools apply sophisticated reachability analyses to achieve high accuracy; however, they need additional data (inparticular, concrete execution traces, such as those obtained by running a test suite) that is not always readily available. we propose SIEGE, a novel automatic exploit generation approach based on genetic algorithms, which generates test cases that execute the methods in a library known to contain a vulnerability. These test cases represent precious, concrete evidence that the vulnerable code can indeed be reached; they are also useful for security researchers to better understand how the vulnerability could be exploited in practice. This technique has been implemented as an extension of EVOSUITE and applied on set of 11 vulnerabilities exhibited by widely used OSS JAVA libraries. Our initial findings show promising results that deserve to be assessed further in larger-scale empirical studies.",
• notes = "SeSa Lab - University of Salerno, Fisciano, Italy",

}

Genetic Programming entries for Emanuele Iannone Dario Di Nucci Antonino Sabetta Andrea De Lucia

Citations