Automatically Assessing Vulnerabilities Discovered by Compositional Analysis

TL;DR

This paper introduces a framework that automatically assesses the severity of vulnerabilities found by compositional analysis tools using heuristics and machine learning, aiding developers in prioritizing security issues.

Contribution

It presents a novel approach combining heuristics and machine learning to assign CVSS3 scores to vulnerabilities discovered through compositional analysis.

Findings

The framework can predict CVSS3 scores with high accuracy.

Community feedback improves the model's feature set.

Effective in assisting developers across 21 open-source projects.

Abstract

Testing is the most widely employed method to find vulnerabilities in real-world software programs. Compositional analysis, based on symbolic execution, is an automated testing method to find vulnerabilities in medium- to large-scale programs consisting of many interacting components. However, existing compositional analysis frameworks do not assess the severity of reported vulnerabilities. In this paper, we present a framework to analyze vulnerabilities discovered by an existing compositional analysis tool and assign CVSS3 (Common Vulnerability Scoring System v3.0) scores to them, based on various heuristics such as interaction with related components, ease of reachability, complexity of design and likelihood of accepting unsanitized input. By analyzing vulnerabilities reported with CVSS3 scores in the past, we train simple machine learning models. By presenting our interactive framework to developers of popular open-source software and other security experts, we gather feedback on our trained models and further improve the features to increase the accuracy of our predictions. By providing qualitative (based on community feedback) and quantitative (based on prediction accuracy) evidence from 21 open-source programs, we show that our severity prediction framework can effectively assist developers with assessing vulnerabilities.