Inferring Patterns for Taint-Style Vulnerabilities with Security Patches

Taint-style vulnerabilities can damage the service provided by mobile seriously. Pattern-based method is a practical way to detect taint-style vulnerabilities. Most of the methods extract the vulnerability patterns from the code base, however, sometimes missing the vulnerability patterns and resulting some vulnerabilities undiscovered. The security patches contain the valuable information about the vulnerabilities. To compensate the inherent incompleteness of pattern matching, in this paper, we propose an approach to infer patterns with the security information carried on the security patches. The taint-style vulnerability is described as a 3-tuples (Ssrc,Ssan,Ssink) here, which consist with sources(Ssrc),sanitization (Ssan) and sinks(Ssink). For each pair of vulnerable and patched programs, we extract the sanitizations from the changes between the vulnerable code and corresponding patches, infer the sinks with the impact analysis, and determine the sources through the backward traversal on the control flow graph. Finally, the complete-linkage clustering method is applied on the the extracted triples to summary the patterns. We evaluate our method with open source projects. The results show our method is effective: 1) our method infers vulnerability patterns for taint-style vulnerabilities; 2) compared with the method inferring patterns from code base, new patterns are discovered; 3)the inferred patterns are applied to search the similar vulnerabilities successfully.