MVP: Detecting Vulnerabilities using Patch-Enhanced Vulnerability Signatures

Authors: 

Yang Xiao, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China and School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China; Bihuan Chen, School of Computer Science and Shanghai Key Laboratory of Data Science, Fudan University, China; Chendong Yu, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China and School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China; Zhengzi Xu, School of Computer Science and Engineering, Nanyang Technological University, Singapore; Zimu Yuan, Feng Li, and Binghong Liu, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China and School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China; Yang Liu, School of Computer Science and Engineering, Nanyang Technological University, Singapore; Wei Huo and Wei Zou, Institute of Information Engineering, Chinese Academy of Sciences, Beijing, China and School of Cyber Security, University of Chinese Academy of Sciences, Beijing, China; Wenchang Shi, Renmin University of China, Beijing, China

Abstract: 

Recurring vulnerabilities widely exist and remain undetected in real-world systems, which are often resulted from reused code base or shared code logic. However, the potentially small differences between vulnerable functions and their patched functions as well as the possibly large differences between vulnerable functions and target functions to be detected bring challenges to clone-based and function matching-based approaches to identify these recurring vulnerabilities, i.e., causing high false positives and false negatives.

In this paper, we propose a novel approach to detect recurring vulnerabilities with low false positives and low false negatives. We first use our novel program slicing to extract vulnerability and patch signatures from vulnerable function and its patched function at syntactic and semantic levels. Then a target function is identified as potentially vulnerable if it matches the vulnerability signature but does not match the patch signature. We implement our approach in a tool named MVP. Our evaluation on ten open-source systems has shown that, i) MVP significantly outperformed state-of-the-art clone-based and function matching-based recurring vulnerability detection approaches; ii) MVP detected recurring vulnerabilities that cannot be detected by general-purpose vulnerability detection approaches, i.e., two learning-based approaches and two commercial tools; and iii) MVP has detected 97 new vulnerabilities with 23 CVE identifiers assigned.

Open Access Media

USENIX is committed to Open Access to the research presented at our events. Papers and proceedings are freely available to everyone once the event begins. Any video, audio, and/or slides that are posted after the event are also free and open to everyone. Support USENIX and our commitment to Open Access.

BibTeX
@inproceedings {251516,
author = {Yang Xiao and Bihuan Chen and Chendong Yu and Zhengzi Xu and Zimu Yuan and Feng Li and Binghong Liu and Yang Liu and Wei Huo and Wei Zou and Wenchang Shi},
title = {{MVP}: Detecting Vulnerabilities using Patch-Enhanced Vulnerability Signatures},
booktitle = {29th {USENIX} Security Symposium ({USENIX} Security 20)},
year = {2020},
isbn = {978-1-939133-17-5},
pages = {1165--1182},
url = {https://www.usenix.org/conference/usenixsecurity20/presentation/xiao},
publisher = {{USENIX} Association},
month = aug,
}

Presentation Video