Skip to main content
SpringerLink
Log in

Survey of Automated Vulnerability Detection and Exploit Generation Techniques in Cyber Reasoning Systems

  • Conference paper
  • First Online:
Intelligent Computing (SAI 2018)

Part of the book series: Advances in Intelligent Systems and Computing ((AISC,volume 857))

Included in the following conference series:

Abstract

Software is everywhere, from mission critical systems such as industrial power stations, pacemakers and even household appliances. This growing dependence on technology and the increasing complexity of software has serious security implications as it means we are potentially surrounded by software that contains exploitable vulnerabilities. These challenges have made binary analysis an important area of research in computer science and has emphasized the need for building automated analysis systems that can operate at scale, speed and efficiency; all while performing with the skill of a human expert. Though great progress has been made in this area of research, there remains limitations and open challenges to be addressed. Recognizing this need, DARPA sponsored the Cyber Grand Challenge (CGC), a competition to showcase the current state of the art in systems that perform; automated vulnerability detection, exploit generation and software patching. This paper is a survey of the vulnerability detection and exploit generation techniques, underlying technologies and related works of two of the winning systems Mayhem and Mechanical Phish.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 169.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 219.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. DARPA: Cyber Grand Challenge. https://www.cybergrandchallenge.com/

  2. LeCun, Y., Cortes, C., Burges, C.J.: The MNIST Database of handwritten digits. http://yann.lecun.com/exdb/mnist/

  3. LeCun, Y., Bottou, L., Bengio, Y., Haffner, P.: Gradient-Based Learning Applied to Document Recognition (1998)

    Article  Google Scholar 

  4. Shoshitaishvili, Y., Wang, R., Salls, C., Stephens, N., Polino, M., Dutcher, A., Grosen, J., Feng, S., Hauser, C., Kruegel, C., Vigna, G.: SOK: (State of) the art of war: offensive techniques in binary analysis. In: 2016 IEEE Symposium on Security and Privacy (SP), pp. 138–157 (2016)

    Google Scholar 

  5. DARPA: Cyber Grand Challenge GitHub Repository & Competitor Portal. https://github.com/CyberGrandChallenge, https://cgc.darpa.mil/

  6. DARPA: DARPA Cyber Grand Challenge: CQE Scoring Document, pp. 1–5 (2014). https://cgc.darpa.mil/CQE_Scoring.pdf

  7. Balakrishnan, G., Reps, T., Melski, D., Teitelbaum, T.: WYSINWYX: what you see is not what you execute. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 4171 LNCS, pp. 202–213 (2008)

    Chapter  Google Scholar 

  8. Copeland, L.: A Practitioner’s Guide to Software Test Design. Artech House, chap. 10, p. 300 (2004)

    Google Scholar 

  9. Nethercote, N.: Dynamic Binary Analysis and Instrumentation or Building Tools is Easy. Ph.D. dissertation, Trinity College (2004)

    Google Scholar 

  10. Cha, S.K., Avgerinos, T., Rebert, A., Brumley, D.: Unleashing Mayhem on binary code. In: Proceedings - IEEE Symposium on Security and Privacy, pp. 380–394 (2012)

    Google Scholar 

  11. Chipounov, V., Kuznetsov, V., Candea, G.: S2E: a platform for in-vivo multi-path analysis of software systems. Asplos 46, 1–14 (2011)

    Google Scholar 

  12. Bjorner, N. Moura, L.D.: Satisfiability modulo theories: introduction and applications. Commun. ACM 69–77 (2011)

    Google Scholar 

  13. Li, Y., Albarghouthi, A., Kincad, Z., Gurfinkel, A., Chechik, M., Kincaid, Z., Gurfinkel, A., Chechik, M.: Symbolic optimization with SMT solvers. In: Proceedings of the 41st ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages - POPL 2014, pp. 607–618 (2014)

    Google Scholar 

  14. Sen, K., Marinov, D., Agha, G., Sen, K., Marinov, D., Agha, G.: CUTE: a concolic unit testing engine for C. In: 10th European Software Engineering Conference and 13th ACM SIGSOFT International Symposium on Foundations of Software Engineering (ESEC/FSE 2005), vol. 30, no. 5, p. 263 (2005)

    Google Scholar 

  15. Cadar, C., Dunbar, D., Engler, D.R.: KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs. In: Proceedings of the 8th USENIX Conference on Operating Systems Design and Implementation, pp. 209–224 (2008)

    Google Scholar 

  16. Martignoni, L., McCamant, S., Poosankam, P., Song, D., Maniatis, P.: Path-exploration lifting: Hi-Fi tests for Lo-Fi emulators. In: Proceedings of the 17th international conference on Architectural Support for Programming Languages and Operating Systems (ASPLOS), pp. 337–348 (2012)

    Google Scholar 

  17. Cadar, C., Sen, K.: Symbolic execution for software testing: three decades later. Commun. ACM 56(2), 82–90 (2013)

    Article  Google Scholar 

  18. Stephens, N., Grosen, J., Salls, C., Dutcher, A., Wang, R., Corbetta, J., Shoshitaishvili, Y., Kruegel, C., Vigna, G.: Driller: augmenting fuzzing through selective symbolic execution. Ndss, pp. 21–24, February 2016

    Google Scholar 

  19. CVE Details - Vulnerabilities By Type. https://www.cvedetails.com/vulnerabilities-by-types.php

  20. Schwartz, E.J., Avgerinos, T., Brumley, D., Schwartz, E.J., Avgerinos, T., Brumley, D.: All You Ever Wanted to Know About Dynamic Taint Analysis Forward Symbolic Execution (but might have been afraid to ask) A Few Things You Need to Know About Dynamic Taint Analysis Forward Symbolic Execution (but might have been afraid to ask) The Root, pp. 1–5 (2010)

    Google Scholar 

  21. Brumley, D., Jager, I., Avgerinos, T., Schwartz, E.J.: BAP: a binary analysis platform. In: Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 6806. LNCS, pp. 463–469 (2011)

    Chapter  Google Scholar 

  22. Avgerinos, T., Cha, S.K., Hao, B.L.T., Brumley, D.: AEG: Automatic exploit generation. In: Proceedings of the Network and Distributed System Security Symposium, February 2011

    Google Scholar 

  23. AFL: Technical “whitepaper” for afl-fuzz. http://lcamtuf.coredump.cx/afl/technical_details.txt

  24. Bellard, F.: QEMU, a fast and portable dynamic translator. In: Proceedings of the 2005 Conference on USENIX Annual Technical Conference, pp. 41–46 (2005)

    Google Scholar 

  25. Nethercote, N., Seward, J.: Valgrind: a framework for heavyweight dynamic binary instrumentation. ACM Sigplan Not. 42(6), 89–100 (2007)

    Article  Google Scholar 

  26. Shoshitaishvili, Y., Wang, R., Hauser, C., Kruegel, C., Vigna, G.: Firmalice - automatic detection of authentication bypass vulnerabilities in binary firmware. In: Proceedings 2015 Network and Distributed System Security Symposium, pp. 8–11, February 2015

    Google Scholar 

  27. mechaphish github repository. https://github.com/mechaphish/mecha-docs

  28. Rex - Automated Exploitation Engine. https://github.com/shellphish/rex

  29. Mnih, V., Kavukcuoglu, K., Silver, D., Rusu, A.A., Veness, J., Bellemare, M.G., Graves, A., Riedmiller, M., Fidjeland, A.K., Ostrovski, G., Petersen, S., Beattie, C., Sadik, A., Antonoglou, I., King, H., Kumaran, D., Wierstra, D., Legg, S., Hassabis, D.: Human-level control through deep reinforcement learning. Nature 518(7540), 529–533 (2015). http://dx.doi.org/10.1038/nature14236

    Article  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Seidenberg School of Computer Science and Information Systems, Pace University, New York, NY, USA

    Teresa Nicole Brooks

Authors
  1. Teresa Nicole Brooks
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Teresa Nicole Brooks .

Editor information

Editors and Affiliations

  1. Faculty of Science and Engineering, Department of Information Science, Saga University, Honjo, Saga, Japan

    Kohei Arai

  2. The Science and Information (SAI) Organization, Bradford, West Yorkshire, UK

    Supriya Kapoor

  3. The Science and Information (SAI) Organization, Bradford, West Yorkshire, UK

    Rahul Bhatia

Rights and permissions

Reprints and permissions

Copyright information

© 2019 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Brooks, T.N. (2019). Survey of Automated Vulnerability Detection and Exploit Generation Techniques in Cyber Reasoning Systems. In: Arai, K., Kapoor, S., Bhatia, R. (eds) Intelligent Computing. SAI 2018. Advances in Intelligent Systems and Computing, vol 857. Springer, Cham. https://doi.org/10.1007/978-3-030-01177-2_79

Download citation

Publish with us

Policies and ethics

Search

Navigation