Finding Fixed Vulnerabilities with Off-the-Shelf Static Analysis

Trevor Dunlap, Seaver Thorn, William Enck, and Bradley Reaves

IEEE European Symposium on Security and Privacy, 2023

Differential Alert Analysis compares static analysis results across commits to discover silently fixed vulnerabilities with high precision, even when using noisy off-the-shelf SAST tools.

Abstract

Software depends on upstream projects that regularly ﬁx vulnerabilities, but the documentation of those vulnerabilities is often unreliable or unavailable. Automating the collection of existing vulnerability ﬁxes is essential for downstream projects to reliably update their dependencies due to the sheer number of dependencies in modern software. Prior efforts rely solely on incomplete databases or imprecise or inaccurate statistical analysis of upstream repositories. In this paper, we introduce Differential Alert Analysis (DAA) to discover vulnerability ﬁxes in software projects. In contrast to statistical analysis, DAA leverages static analysis security testing (SAST) tools, which reason over code context and semantics. We provide a language-independent implementation of DAA and show that for Python and Java based projects, DAA has high precision for a ground-truth dataset of vulnerability ﬁxes — even with noisy and low-precision SAST tools. We then use DAA in two large-scale empirical studies covering several prominent ecosystems, ﬁnding hundreds of resolved alerts, including many never publicly disclosed. DAA thus provides a powerful, accurate primitive for software projects, code analysis tools, vulnerability databases, and researchers to characterize and enhance the security of software supply chains.

Citation (IEEE)

T. Dunlap, S. Thorn, W. Enck, and B. Reaves, “Finding Fixed Vulnerabilities with Off-the-Shelf Static Analysis,” in IEEE European Symposium on Security and Privacy, 2023.

BibTeX

@inproceedings{dter23,
  author = {{Trevor Dunlap} and Thorn, Seaver and Enck, William and {Bradley Reaves}},
  booktitle = {{IEEE} European Symposium on Security and Privacy},
  date = {2023-07},
  title = {{ Finding Fixed Vulnerabilities with Off-the-Shelf Static Analysis}},
}