| |
Design and Implementation of Security Graph Language (SGL)
|
Speaker (s):
Dr. Asankhaya Sharma
Director of Software Engineering,
CA Veracode
|
|
Date:
Time:
Venue:
|
|
October 9, 2018, Tuesday
10:00am - 11:00am
Meeting Room 4.4, Level 4
School of Information Systems
Singapore Management University
80 Stamford Road
Singapore 178902
|
|
ABSTRACT
Today software is built in fundamentally different ways from how it was a decade ago. It is increasingly common for applications to be assembled out of open-source components, resulting in the use of large amounts of third-party code. This third-party code is a means for vulnerabilities to make their way downstream into applications. Recent vulnerabilities such as Heartbleed, FREAK SSL/TLS, GHOST, and the Equifax data breach (due to a flaw in Apache Struts) were ultimately caused by third-party components. We argue that an automated way to audit the open-source ecosystem, catalog existing vulnerabilities, and discover new flaws is essential to using open-source safely. To this end, we describe the Security Graph Language (SGL), a domain-specific language for analysing graph-structured datasets of open-source code and cataloguing vulnerabilities. SGL allows users to express complex queries on relations between libraries and vulnerabilities in the style of a program analysis language. SGL queries double as an executable representation for vulnerabilities, allowing vulnerabilities to be automatically checked against a database and deduplicated using a canonical representation. We outline a novel optimisation for SGL queries based on regular path query containment, improving query performance by up to 3 orders of magnitude. We also demonstrate the effectiveness of SGL in practice to find zero-day vulnerabilities by identifying several flaws in the open-source version of Oracle GlassFish Server.
About the Speaker
Dr. Asankhaya Sharma is the Director of Software Engineering at CA Veracode. Asankhaya is a cyber security expert and technology leader with over a decade of experience in creating security products for industry, academia and open-source community. He is passionate about building high performing teams and taking innovative products to market.
|
