Security breaches cause millions of dollars in damage every year. In addition to industry, public administration, critical infrastructures such as hospitals, and numerous private individuals are also affected. Regular reports of hacker attacks and data leaks have long since become the norm in our networked digital world. Attackers today mostly exploit vulnerabilities and mistakes in the design and implementation of application logic. Standard measures such as firewalls and virus scanners are not sufficient to prevent targeted attacks on gaps in software, as large-scale ransomware attacks have shown.

A wide range of vulnerability classes is known to research as the cause of these gaps, including missing or incorrect authentication, issues with input sanitization, misconfiguration of sensitive APIs such as cryptographic features, insecure backend communication, unclear or improper trust models between components, and many others. Software security, or more precisely: the rapid detection and remediation of such vulnerabilities, is essential to ensure adequate privacy and cybersecurity.

Due to the complexity and size of modern software systems, manually verifying their code hasn’t been reasonable long since and is getting increasingly unrealistic. Systems nowadays consist of a large number of individual heterogeneous components that interact through various interfaces, where even the individual components can have hundreds of thousands or even millions of lines of code. Further, especially corporate back office software is usually developed, maintained, and customized over decades with different teams and responsibilities. These products therefore often lack a single, consistent and easily recognizable structure. Therefore, when the system is expanded, it is often built on an existing code base without knowing the original design decisions or reasons and without having direct access to the original developers. Nevertheless, the latest technologies must be integrated and current requirements met.

The ATHENE research area AVSV is advancing the state of the art in automatic vulnerability detection. The goal is to provide code analysis tools and techniques that are precise, scalable and that identify the types of vulnerabilities that are missed by current scanners.

ATHENE defines the following challenges for an ideal code scanner: