Supporting automated vulnerability analysis using formalized vulnerability signatures

Mohamed Almorsy, John Grundy, Amani S. Ibrahim

Research output: Chapter in Book/Report/Conference proceedingConference PaperResearchpeer-review

24 Citations (Scopus)


Adopting publicly accessible platforms such as cloud computing model to host IT systems has become a leading trend. Although this helps to minimize cost and increase availability and reachability of applications, it has serious implications on applications' security. Hackers can easily exploit vulnerabilities in such publically accessible services. In addition to, 75% of the total reported application vulnerabilities are web application specific. Identifying such known vulnerabilities as well as newly discovered vulnerabilities is a key challenging security requirement. However, existing vulnerability analysis tools cover no more than 47% of the known vulnerabilities. We introduce a new solution that supports automated vulnerability analysis using formalized vulnerability signatures. Instead of depending on formal methods to locate vulnerability instances where analyzers have to be developed to locate specific vulnerabilities, our approach incorporates a formal vulnerability signature described using OCL. Using this formal signature, we perform program analysis of the target system to locate signature matches (i.e. signs of possible vulnerabilities). A newly-discovered vulnerability can be easily identified in a target program provided that a formal signature for it exists. We have developed a prototype static vulnerability analysis tool based on our formalized vulnerability signatures specification approach. We have validated our approach in capturing signatures of the OWSAP Top10 vulnerabilities and applied these signatures in analyzing a set of seven benchmark applications.

Original languageEnglish
Title of host publication2012 27th IEEE/ACM International Conference on Automated Software Engineering, ASE 2012 - Proceedings
Number of pages10
Publication statusPublished - 2012
Externally publishedYes
EventAutomated Software Engineering Conference 2012 - Atlantic Congress Hotel, Essen, Germany
Duration: 3 Sep 20127 Sep 2012
Conference number: 27th (Conference website) (Proceedings)


ConferenceAutomated Software Engineering Conference 2012
Abbreviated titleASE 2012
OtherIEEE/ACM International Conference on Automated Software Engineering, ASE 2012
Internet address


  • Common weaknesses enumeration (CWE)
  • Formal vulnerability specification
  • Software security
  • Vulnerability analysis

Cite this