An Analysis Framework and Additive Software Analysis

Author(s)

Paul E. Black

Abstract

We present a framework for software assurance, in addition to an additive software analysis approach. Both have the potential to dramatically reduce software vulnerabilities within the next seven years. The framework (1) aggregates tool outputs, (2) allows software assurance checkers to interoperate, and (3) passes program information between tools. The framework allows modular and distributed development of tool capabilities, promotes synergy between groups, and enables the development of hybrid tools. The framework requires documentary standards of the information passed, such as, code location, visible variables and their values, data and control flows, assertions and invariants, function signatures, and code weaknesses. Additive software analysis uses the framework to gather information, compare and confirm tool results, and enable one module to build on the capabilities of other modules.

Citation

Dramatically Reducing Security Vulnerabilities

Pub Weblink

https://samate.nist.gov/DRSV2016/

Pub Type

Websites

Keywords

software assurance

Citation

Black, P. (1970), An Analysis Framework and Additive Software Analysis, Dramatically Reducing Security Vulnerabilities, [online], https://samate.nist.gov/DRSV2016/ (Accessed April 24, 2024)