Mockingbird: A Framework for Enabling Targeted Dynamic Analysis of Java Programs
The paper presents the Mockingbird framework that combines static and dynamic analyses to yield an efficient and scalable approach to analyze large Java software. The framework is an innovative integration of existing static and dynamic analysis tools and a newly developed component called the Object Mocker that enables the integration. The static analyzers are used to extract potentially vulnerable parts from large software. Targeted dynamic analysis is used to analyze just the potentially vulnerable parts to check whether the vulnerability can actually be exploited.
We present a case study to illustrate the use of the framework to analyze complex software vulnerabilities. The case study is based on a challenge application from the DARPA Space/Time Analysis for Cybersecurity (STAC) program. Interestingly, the challenge program had been hardened and was thought not to be vulnerable. Yet, using the framework we could discover an unintentional vulnerability that can be exploited for a denial of service attack. The accompanying demo video depicts the case study.
Wed 29 MayDisplayed time zone: Eastern Time (US & Canada) change
16:00 - 18:00
|Easy Modelling and Verification of Unpredictable and Preemptive Interrupt-driven SystemsTechnical Track|
|Towards Understanding and Reasoning about Android InteroperationsTechnical Track|
|ALPACA: A Large Portfolio-based Alternating Conditional AnalysisDemos|
|Mockingbird: A Framework for Enabling Targeted Dynamic Analysis of Java ProgramsDemos|
|Zero-Overhead Path Prediction with Progressive Symbolic ExecutionTechnical Track|