ITS4: a static vulnerability scanner for C and C++ code

By John Viega, J. Bloch, Tadayoshi Kohno, Gary E. McGraw Jr.. Asia-Pacific Computer Systems Architecture Conference, 2000

418 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/fefc45eeca894ca84af2ddb70a7e6fd5ae39b641

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

In Signal Processing

Citations in the corpus

Vulnerability detection with fine-grained interpretations (2021, methodology): “The rule-based approaches were developed to leverage known vulnerability patterns to discover possible vulnerable code, such as FlawFinder [7], RATS [9], ITS4 [33], Checkmarx [1], Fortify [8] and Coverity [2].”
N-Variant Systems: A Secretless Framework for Security through Diversity (2006, background): “Buffer overflows have been widely studied and numerous defenses have been developed including static analysis to detect and eliminate the vulnerabilities [66, 67, 39, 23], program transformation and dynamic detection techniques [19, 5, 30, 45, 49, 57] and hardware modifications [38, 40, 41, 64].”
Improving Security Using Extensible Lightweight Static Analysis (2002, methodology): “Several security scanning tools provide similar functionality, including Flawfinder (www. dwheeler.com/flawfinder), ITS4, 9 and the Rough Auditing Tool for Security (www. securesw.com/rats).”
Securing web application code by static analysis and runtime protection (2004, methodology): “Most efforts to develop checkers have resulted in publicly available tools [16], including BOON by Wagner et al. [71], RATS by Secure Software [64], FlawFinder by Wheeler [75], PScan by DeKok [20], Splint by Larochelle and Evans [44], and ITS4 by Viega et al. [69].”
A Security Perspective on Code Review: The Case of Chromium (2016, background): “Despite being an historically famous category of issue, with books [38] and tools [39] written to prevent and address them, it is still causing its fair share of trouble.”
An Empirical Study of C++ Vulnerabilities in Crowd-Sourced Code Examples (2019, background): “, memory corruption bugs) that easily lead to vulnerable code and exploitable applications [44], [45], [46].”