SoK: Sanitizing for security

Dokyung Song; Julian Lettner; Prabhu Rajasekaran; Yeoul Na; Stijn Volckaert; Per Larsen; Michael Franz

doi:10.1109/SP.2019.00010

SoK: Sanitizing for security

Dokyung Song, Julian Lettner, Prabhu Rajasekaran, Yeoul Na, Stijn Volckaert, Per Larsen, Michael Franz

College of Computing

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

71 Citations (Scopus)

Abstract

The C and C++ programming languages are notoriously insecure yet remain indispensable. Developers therefore resort to a multi-pronged approach to find security issues before adversaries. These include manual, static, and dynamic program analysis. Dynamic bug finding tools - henceforth 'sanitizers' - can find bugs that elude other types of analysis because they observe the actual execution of a program, and can therefore directly observe incorrect program behavior as it happens. A vast number of sanitizers have been prototyped by academics and refined by practitioners. We provide a systematic overview of sanitizers with an emphasis on their role in finding security issues. Specifically, we taxonomize the available tools and the security vulnerabilities they cover, describe their performance and compatibility properties, and highlight various trade-offs.

Original language	English
Title of host publication	Proceedings - 2019 IEEE Symposium on Security and Privacy, SP 2019
Publisher	Institute of Electrical and Electronics Engineers Inc.
Pages	1275-1295
Number of pages	21
ISBN (Electronic)	9781538666609
DOIs	https://doi.org/10.1109/SP.2019.00010
Publication status	Published - 2019 May
Event	40th IEEE Symposium on Security and Privacy, SP 2019 - San Francisco, United States Duration: 2019 May 19 → 2019 May 23

Publication series

Name	Proceedings - IEEE Symposium on Security and Privacy
Volume	2019-May
ISSN (Print)	1081-6011

Conference

Conference	40th IEEE Symposium on Security and Privacy, SP 2019
Country/Territory	United States
City	San Francisco
Period	19/5/19 → 19/5/23

Bibliographical note

Publisher Copyright:
© 2019 IEEE.

All Science Journal Classification (ASJC) codes

Safety, Risk, Reliability and Quality
Software
Computer Networks and Communications

Access to Document

10.1109/SP.2019.00010

Cite this

Song, D., Lettner, J., Rajasekaran, P., Na, Y., Volckaert, S., Larsen, P., & Franz, M. (2019). SoK: Sanitizing for security. In Proceedings - 2019 IEEE Symposium on Security and Privacy, SP 2019 (pp. 1275-1295). Article 8835294 (Proceedings - IEEE Symposium on Security and Privacy; Vol. 2019-May). Institute of Electrical and Electronics Engineers Inc.. https://doi.org/10.1109/SP.2019.00010

@inproceedings{8bdbe37d379c492995021e8a811368a8,

title = "SoK: Sanitizing for security",

abstract = "The C and C++ programming languages are notoriously insecure yet remain indispensable. Developers therefore resort to a multi-pronged approach to find security issues before adversaries. These include manual, static, and dynamic program analysis. Dynamic bug finding tools - henceforth 'sanitizers' - can find bugs that elude other types of analysis because they observe the actual execution of a program, and can therefore directly observe incorrect program behavior as it happens. A vast number of sanitizers have been prototyped by academics and refined by practitioners. We provide a systematic overview of sanitizers with an emphasis on their role in finding security issues. Specifically, we taxonomize the available tools and the security vulnerabilities they cover, describe their performance and compatibility properties, and highlight various trade-offs.",

author = "Dokyung Song and Julian Lettner and Prabhu Rajasekaran and Yeoul Na and Stijn Volckaert and Per Larsen and Michael Franz",

note = "Publisher Copyright: {\textcopyright} 2019 IEEE.; 40th IEEE Symposium on Security and Privacy, SP 2019 ; Conference date: 19-05-2019 Through 23-05-2019",

year = "2019",

month = may,

doi = "10.1109/SP.2019.00010",

language = "English",

series = "Proceedings - IEEE Symposium on Security and Privacy",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

pages = "1275--1295",

booktitle = "Proceedings - 2019 IEEE Symposium on Security and Privacy, SP 2019",

address = "United States",

}

Song, D, Lettner, J, Rajasekaran, P, Na, Y, Volckaert, S, Larsen, P & Franz, M 2019, SoK: Sanitizing for security. in Proceedings - 2019 IEEE Symposium on Security and Privacy, SP 2019., 8835294, Proceedings - IEEE Symposium on Security and Privacy, vol. 2019-May, Institute of Electrical and Electronics Engineers Inc., pp. 1275-1295, 40th IEEE Symposium on Security and Privacy, SP 2019, San Francisco, United States, 19/5/19. https://doi.org/10.1109/SP.2019.00010

SoK: Sanitizing for security. / Song, Dokyung; Lettner, Julian; Rajasekaran, Prabhu et al.
Proceedings - 2019 IEEE Symposium on Security and Privacy, SP 2019. Institute of Electrical and Electronics Engineers Inc., 2019. p. 1275-1295 8835294 (Proceedings - IEEE Symposium on Security and Privacy; Vol. 2019-May).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

TY - GEN

T1 - SoK

T2 - 40th IEEE Symposium on Security and Privacy, SP 2019

AU - Song, Dokyung

AU - Lettner, Julian

AU - Rajasekaran, Prabhu

AU - Na, Yeoul

AU - Volckaert, Stijn

AU - Larsen, Per

AU - Franz, Michael

PY - 2019/5

Y1 - 2019/5

N2 - The C and C++ programming languages are notoriously insecure yet remain indispensable. Developers therefore resort to a multi-pronged approach to find security issues before adversaries. These include manual, static, and dynamic program analysis. Dynamic bug finding tools - henceforth 'sanitizers' - can find bugs that elude other types of analysis because they observe the actual execution of a program, and can therefore directly observe incorrect program behavior as it happens. A vast number of sanitizers have been prototyped by academics and refined by practitioners. We provide a systematic overview of sanitizers with an emphasis on their role in finding security issues. Specifically, we taxonomize the available tools and the security vulnerabilities they cover, describe their performance and compatibility properties, and highlight various trade-offs.

AB - The C and C++ programming languages are notoriously insecure yet remain indispensable. Developers therefore resort to a multi-pronged approach to find security issues before adversaries. These include manual, static, and dynamic program analysis. Dynamic bug finding tools - henceforth 'sanitizers' - can find bugs that elude other types of analysis because they observe the actual execution of a program, and can therefore directly observe incorrect program behavior as it happens. A vast number of sanitizers have been prototyped by academics and refined by practitioners. We provide a systematic overview of sanitizers with an emphasis on their role in finding security issues. Specifically, we taxonomize the available tools and the security vulnerabilities they cover, describe their performance and compatibility properties, and highlight various trade-offs.

UR - http://www.scopus.com/inward/record.url?scp=85053860168&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85053860168&partnerID=8YFLogxK

U2 - 10.1109/SP.2019.00010

DO - 10.1109/SP.2019.00010

M3 - Conference contribution

AN - SCOPUS:85053860168

T3 - Proceedings - IEEE Symposium on Security and Privacy

SP - 1275

EP - 1295

BT - Proceedings - 2019 IEEE Symposium on Security and Privacy, SP 2019

PB - Institute of Electrical and Electronics Engineers Inc.

Y2 - 19 May 2019 through 23 May 2019

ER -

SoK: Sanitizing for security

Abstract

Publication series

Conference

Bibliographical note

All Science Journal Classification (ASJC) codes

Access to Document

Other files and links

Fingerprint

Cite this