Student or educator? Sign up with your school email and get 6 months of Pro free.
CoChat
Sign Up
Cited by 808

The DOI matches its Crossref record; 1 of the 1 references it cites were found in a registry or an index.

Modeling and Discovering Vulnerabilities with Code Property Graphs

Yamaguchi, Fabian, Golde, Nico, Arp, Daniel, Rieck, Konrad·2014·2014 IEEE Symposium on Security and Privacy
DOI 10.1109/sp.2014.44
Open this paper in CoChat — free account

Abstract

The vast majority of security breaches encountered today are a direct result of insecure code. Consequently, the protection of computer systems critically depends on the rigorous identification of vulnerabilities in software, a tedious and error-prone process requiring significant expertise. Unfortunately, a single flaw suffices to undermine the security of a system and thus the sheer amount of code to audit plays into the attacker's cards. In this paper, we present a method to effectively mine large amounts of source code for vulnerabilities. To this end, we introduce a novel representation of source code called a code property graph that merges concepts of classic program analysis, namely abstract syntax trees, control flow graphs and program dependence graphs, into a joint data structure. This comprehensive representation enables us to elegantly model templates for common vulnerabilities with graph traversals that, for instance, can identify buffer overflows, integer overflows, format string vulnerabilities, or memory disclosures. We implement our approach using a popular graph database and demonstrate its efficacy by identifying 18 previously unknown vulnerabilities in the source code of the Linux kernel.

Overview

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

Crossref · 10.1109/sp.2014.44

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Verification

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Citations

Cites

Show all 1 references

Research works printed but not linked: 44

  1. 10.1109/ICSM.1994.336777 · doi:10.1109/icsm.1994.336777
  2. 10.1109/SP.2010.26 · DOI · Paper page
  3. 10.1145/53990.53994 · doi:10.1145/53990.53994
  4. shankar, 2001, Detecting format string vulnerabilities with type qualifiers, Proc of USENIX Security Symposium, 201
  5. 10.1109/SP.2006.29 · DOI · Paper page
  6. 10.1145/512529.512539 · doi:10.1145/512529.512539
  7. 10.4018/978-1-61350-053-8.ch002 · DOI
  8. 10.1109/MSP.2011.70 · doi:10.1109/msp.2011.70
  9. 10.1109/SP.2013.12 · doi:10.1109/sp.2013.12
  10. 10.1145/2093548.2093564 · DOI · Paper page
  11. goldsmith, 2005, Relational queries over program traces, Proc ACM SIGPLAN Conf Object-Oriented Programing Systems Languages and Applications (OOPSLA 97)
  12. 10.1109/ACSAC.2007.27 · doi:10.1109/acsac.2007.27
  13. 10.1145/2517312.2517315 · DOI · Paper page
  14. sutton, 2007, Fuzzing Brute Force Vulnerability Discovery
  15. 2002, Advances in format string exploitation, Phrack Magazine
  16. kupsch, 2009, Manual vs automated vulnerability assessment: A case study, Proc of Workshop on Managing Insider Security Threats (MIST), 83
  17. krinke, 1998, Validation of measurement software as an application of slicing and constraint solving, Information and Software Technology, 40, 661, 10.1016/S0950-5849(98)00090-1 · doi:10.1016/s0950-5849(98)00090-1
  18. 10.1145/2420950.2421003 · DOI · Paper page
  19. woo, 2013, Scheduling blackbox mutational fuzzing, Proc of ACM Conference on Computer and Communications Security (CCS)
  20. 10.1109/TSE.1984.5010248 · DOI · Paper page
  21. wang, 2009, IntScope: Automatically detecting integer overflow vulnerability in x86 binary using symbolic execution, Proc of Network and Distributed System Security Symposium (NDSS)
  22. 10.1145/1029894.1029911 · doi:10.1145/1029894.1029911
  23. yamaguchi, 2013, Chucky: Exposing missing checks in source code for vulnerability discovery, Proc of ACM Conference on Computer and Communications Security (CCS)
  24. 10.1145/1065167.1065169 · DOI · Paper page
  25. 10.1109/MS.2004.1293079 · DOI
  26. livshits, 2005, Finding security vulnerabilities in java applications with static analysis, Proc of USENIX Security Symposium
  27. martin, 2005, Finding application errors and security flaws using pql: Program query language, Proc ACM SIGPLAN Conf Object-Oriented Programing Systems Languages and Applications (OOPSLA 97)
  28. moore, 2013, Security flaws in universal plug and play: Unplug. Don't play, Technical Report
  29. 10.1145/2382196.2382215 · doi:10.1145/2382196.2382215
  30. newsome, 2005, Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software, Proc of Network and Distributed System Security Symposium (NDSS)
  31. oh, 2012, Recent Java exploitation trends and malware, Presentation at Black Hat Las Vegas
  32. 10.1109/ICSM.1998.738528 · DOI · Paper page
  33. avgerinos, 2011, AEG: Automatic exploit generation, Proc of Network and Distributed System Security Symposium (NDSS)
  34. 10.1109/ICSE.2009.5070546 · DOI · Paper page
  35. aho, 1985, Compilers Principles Techniques and Tools
  36. 10.1109/32.295894 · DOI · Paper page
  37. esser, 2013, Mountain Lion/iOS vulnerabilities garage sale, Presentation at SyScan Conference
  38. eidemiller, 2012, Cwe-676 Use of Potentially Dangerous Function
  39. reps, 1998, Program analysis via graph reachability, Information and Software Technology, 10.1016/S0950-5849(98)00093-7 · DOI
  40. dekok, 2013, PScan A Limited Problem Scanner for C Source Files
  41. planet, 2010, A eulogy for format strings, Phrack Magazine
  42. chess, 2013, Rough auditing tool for security, Google Code
  43. 10.1145/24039.24041 · DOI · Paper page
  44. 10.1109/52.976940 · doi:10.1109/52.976940

Cited by

See all 808

Metadata

Authors
Yamaguchi, F., Golde, N., Arp, D., & Rieck, K.
Venue
2014 IEEE Symposium on Security and Privacy
Publisher
IEEE
Published
2014-05
Pages
590-604
ISSN
1081-6011 (ISSN-L)
DOI
10.1109/sp.2014.44
OpenAlex
W1992114977
Cited by
808
References
1
FWCI
12.65
Type
conference paper
Language
en
Open access
closed

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review

How to cite

Cite CoChat for the checks on this page, and the paper for its own findings.

This page
CoChat. (2026). Citation check: Modeling and Discovering Vulnerabilities with Code Property Graphs. https://app.cochat.ai/papers/10.1109/sp.2014.44
The paper
Yamaguchi, F., Golde, N., Arp, D., & Rieck, K. (2014). Modeling and Discovering Vulnerabilities with Code Property Graphs. 2014 IEEE Symposium on Security and Privacy. https://doi.org/10.1109/sp.2014.44

Data sources

Bibliographic data: Semantic Scholar, OpenAlex, Crossref.

Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).

Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.