Family-Based Vulnerability Discovery for Highly-Configurable Software Systems

Discoveries such as the infamous Heartbleed vulnerability highlight the importance of analyzing configurable software for the presence of vulnerabilities. Static source code analysis offers two prominent solutions for configurable software: product-based and family-based strategies. Previous research compared the capabilities of these strategies for the discovery of bugs and found that family-based approaches tend to be more effective and efficient. While approaches for product-based vulnerability discovery exist, there currently is no corresponding family-based approach. In this paper, we aim to fill this gap. We extend the analysis platform Vari-Joern, offering product-based vulnerability discovery for configurable software systems, with a family-based approach. Using our extended version of Vari-Joern, we compare product- and family-based vulnerability discovery in terms of their effectiveness and efficiency when applied to three real-world, highly-configurable software systems. Our results indicate that limitations of state-of-the-art variability encoding, along with challenges that arise from analyzing variability-encoded source code, prevent the family-based approach from achieving effectiveness comparable to the product-based alternative. ... mehrNonetheless, its efficiency remains comparable to the product-based analysis. Overall, our work offers insights into the potential of family-based vulnerability discovery and the open issues that remain.