improving security using extensible lightweight static analysis（提高安全使用可扩展的轻量级静态分析）.pdfVIP

building software securely focus Improving Security Using Extensible Lightweight Static Analysis David Evans and David Larochelle, University of Virginia uilding secure systems involves numerous complex and challeng- ing problems, ranging from building strong cryptosystems and Bdesigning authentication protocols to producing a trust model and security policy. Despite these challenges, most security at- tacks exploit either human weaknesses—such as poorly chosen passwords and careless configuration—or software implementation flaws. Although it’s hard to do much about human frailties, some help is available through education, better interface design, and secu- cryptographic problems. Analyses of other Security attacks rity-conscious defaults. With software im- vulnerability and incident reports reveal sim- that exploit plementation flaws, however, the problems ilar repetition. For example, David Wagner well-known are typically both preventable and well and his colleagues found that buffer over- implementation understood. flow vulnerabilities account for approxi- flaws occur with Analyzing reports of security attacks mately 50 percent of the Software Engineer- quickly reveals that most attacks do not re- ing Institute’s CERT advisories.2 disturbing frequency sult from clever attackers discovering new So why