syssec_red_book

9. Legacy Systemsparts of the program that were observed in the learning phase. This means that,if a function has not been executed at all, its vulnerabilities will go undetected.We do not consider detection mechanisms such as anomaly detection orbehavior-based approaches. Although great deal of research has investigated theapplications of these techniques to detect attacks, reducing the number of falsepositives is still the core problem for these systems.9.6 Research GapsWe envision research in the area of legacy software in the following dimensions.9.6.1 Attack DetectionAs already stated, BodyArmour [357] is a tool chain to bolt a layer of protectionon existing C binaries to shield them from memory corruption attacks. Since itis based on dynamic analysis, it also suffers from coverage issues - we can onlyanalyze what we execute. Lack of coverage may cause BodyArmour to missarrays and array accesses and thus lead to false negatives. Another popular,yet very different, approach to analyzing a binary is static analysis. Eventhough the method is less accurate than dynamic analysis, it offers full codecoverage. Consequently, it might be interesting to explore a hybrid solution,which would marry BodyArmour to static protection approaches, such asWIT [80].9.6.2 Search for Vulnerabilities and CrashesThe approaches discussed so far aim at attack detection at production time orin a honeypot. They are effective, but they do not remove the vulnerabilitiesthemselves. Although it is better to crash than to allow exploitation, crashes areundesirable too. Thus, ideally we would like to find as many bugs as possibleby means of fuzz testing even before deploying an application. Fuzzersfeed programs invalid, unexpected, or random data to see if they crash orexhibit unexpected behavior. Information about inputs exploiting a securityvulnerability allows system administrators to filter out offensive inputs, or ifnecessary, stop the application.The most effective fuzzing technique today is whitebox fuzzing [118, 128,195]. By means of symbolic execution, it exercises all possible execution pathsthrough the program and thus uncovers all possible bugs—although it maytake years to do so. Since symbolic execution scales poorly, a possible solutionmight be to focus first on functions/code fragments that look more vulnerablethan others.Previous research has shown that software complexity metrics collectedfrom software artifacts are helpful in finding vulnerable code components [190,300, 349, 418]. However, even though complexity metrics serve as useful in-70