Constructing a Knowledge Base for Software Security Detection Based on Similar Call Graph

Abstract

Software structure is very important for software security. But it is very difficult to obtain software structure by software execution trace. In this paper, by researching system call sequences in the process of software execution, similar call graph is proposed. We present how to generate similar call graph by observed system call sequences. Based on this, a knowledge base for software security detection is constructed. Experiments show false alarm rate can be decreased effectively by the knowledge base and detection rate is higher by using appropriate threshold.