一句话：分析五个开源项目内漏洞在文件、函数、类型与开发者上的分布，提炼12条经验并发现10个0day。
近年来漏洞数量快速增长，使得系统分析漏洞分布并支持关联分析与预测成为可能。已有研究多关注 bug 而非漏洞，或只分析项目间的总体漏洞分布，缺乏对单个项目内部漏洞分布的理解。本文利用自动爬虫并投入数月人工努力，收集了五个代表性开源项目中所有已知漏洞，构成大规模漏洞数据集，并从文件、函数、漏洞类型和负责开发者四个维度分析项目内漏洞分布。基于分析结果，作者提出12条关于漏洞分布的实用经验，并将这些经验应用于静态分析和动态 fuzzing 等漏洞发现方案，最终帮助在目标项目中发现10个零日漏洞，验证了经验的有效性。
The number of vulnerabilities increases rapidly in recent years, due to advances in vulnerability discovery solutions. It enables a thorough analysis on the vulnerability distribution and provides support for correlation analysis and prediction of vulnerabilities. Previous research either focuses on analyzing bugs rather than vulnerabilities, or only studies general vulnerability distribution among projects rather than the distribution within each project. In this paper, we collected a large vulnerability dataset, consisting of all known vulnerabilities associated with five representative open source projects, by utilizing automated crawlers and spending months of manual efforts. We then analyzed the vulnerability distribution within each project over four dimensions, including files, functions, vulnerability types and responsible developers. Based on the results analysis, we presented 12 practical insights on the distribution of vulnerabilities. Finally, we applied such insights on several vulnerability discovery solutions (including static analysis and dynamic fuzzing), and helped them find 10 zero-day vulnerabilities in target projects, showing that our insights are useful.
DOI 原文 ·
@inproceedings{paperbot5640,
title = {A large-scale empirical study on vulnerability distribution within projects and the lessons learned},
author = {Bingchang Liu and Guozhu Meng and Wei Zou and Qi Gong and Feng Li and Min Lin and Dandan Sun and Wei Huo and Chao Zhang},
booktitle = {ICSE},
year = {2020},
doi = {10.1145/3377811.3380923}
}