Research Article
Comparing Lexical Analysis Tools for Buffer Overflow Detection in Network Software
@INPROCEEDINGS{10.1109/COMSWA.2006.1665217, author={Davide Pozza and Riccardo Sisto and Luca Durante and Adriano Valenzano}, title={Comparing Lexical Analysis Tools for Buffer Overflow Detection in Network Software}, proceedings={1st International ICST Conference on Communication System Software and MiddleWare}, publisher={IEEE}, proceedings_a={COMSWARE}, year={2006}, month={8}, keywords={}, doi={10.1109/COMSWA.2006.1665217} }- Davide Pozza
Riccardo Sisto
Luca Durante
Adriano Valenzano
Year: 2006
Comparing Lexical Analysis Tools for Buffer Overflow Detection in Network Software
COMSWARE
IEEE
DOI: 10.1109/COMSWA.2006.1665217
Abstract
Many of the bugs in distributed software modules are security vulnerabilities, the most common and also the most exploited of which are buffer overflows and they typically arise in programs written in the C language. This paper, focusing on static analysis tools for detecting buffer overflows in C programs, presents a methodology for experimentally evaluating and comparing the main objective features of such tools. The proposed method is based on testing all the tools on a common set of publicly available, open source software packages, and makes use of specific metrics defined to evaluate the main tool features. In particular, the evaluation aims at quantifying how close the tool is to a complete and sound tool. Our approach has been applied for an initial evaluation of the class of static analysis tools that are based on lexical analysis, using as test cases three well known network software packages. The results obtained, illustrated and commented on in this paper, offer some interesting indications
