Sciweavers

Share
COMSWARE
2006
IEEE

Comparing lexical analysis tools for buffer overflow detection in network software

9 years 9 months ago
Comparing lexical analysis tools for buffer overflow detection in network software
Many of the bugs in distributed software modules are security vulnerabilities, the most common and also the most exploited of which are buffer overflows and they typically arise in programs written in the C language. This paper, focusing on static analysis tools for detecting buffer overflows in C programs, presents a methodology for experimentally evaluating and comparing the main objective features of such tools. The proposed method is based on testing all the tools on a common set of publicly available, open source software packages, and makes use of specific metrics defined to evaluate the main tool features. In particular, the evaluation aims at quantifying how close the tool is to a complete and sound tool. Our approach has been applied for an initial evaluation of the class of static analysis tools that are based on lexical analysis, using as test cases three well known network software packages. The results obtained, illustrated and commented on in this paper, offer some intere...
Davide Pozza, Riccardo Sisto, Luca Durante, Adrian
Added 10 Jun 2010
Updated 10 Jun 2010
Type Conference
Year 2006
Where COMSWARE
Authors Davide Pozza, Riccardo Sisto, Luca Durante, Adriano Valenzano
Comments (0)
books