Compiler-Based Static Analysis Tools
Network & System Security
Compiler-based static analysis tools at SwRI employ a security policy defined by an expert to automatically transform an untrusted application into a security hardened application.
Build-it-right and remediation are two popular approaches to enhance application security. Southwest Research Institute (SwRI) engineers are developing new techniques that fall within these two areas.
Remediation
Together with the Computer Science Department at the University of Texas in Austin, SwRI engineers are researching and developing a compiler infrastructure that uses a complementary combination of static and dynamic dataflow analysis to:
- Detect security vulnerabilities
- Eliminate threats
- Mitigate security
This “remediation” approach is applied at the end of the development cycle, just before deployment.
Compiler-Based Static Analysis Tools
Compiler-based static analysis tools at SwRI employ a security policy defined by an expert to automatically transform an untrusted application into a security hardened application. Many vulnerabilities can be detected and eliminated at compile time through static analysis. For those that cannot be eliminated, special code is inserted into the application to thwart or mitigate an attack at runtime using dynamic dataflow analysis.
Benefits of SwRI's Security Enhanced Application Services
SwRI's system goes beyond conventional static analysis tools and taint tracking systems that detect vulnerabilities at compile time and runtime respectively, by providing many further benefits such as:
- Very low runtime and memory overhead
- Separation of concerns (security policy separate from development)
- Configurable “fight through” capabilities
- Simultaneous hardening for broad range of vulnerabilities
The following are some of the vulnerabilities or services our system can protect against/provide:
- Format string
- Structured query language (SQL) injection and cross-site scripting
- File disclosure
- Role-based access control
Related Terminology
static analysis • dynamic dataflow analysis • format string • SQL injection • cross-site scripting • tamper-proof software • code obfuscation • data dithering • role-based access control
