%0 Conference Proceedings %T Combining static and dynamic analyses for vulnerability detection: Illustration on heartbleed %+ Search Lab [Budapest] %+ Département Ingénierie Logiciels et Systèmes (DILS) %+ Dassault Aviation %A Kiss, B. %A Kosmatov, N. %A Pariente, D. %A Puccetti, A. %Z Conference of 11th International Haifa Verification Conference, HVC 2015 ; Conference Date: 17 November 2015 Through 19 November 2015; Conference Code:154279 %< avec comité de lecture %B Hardware and Software: Verification and Testing. HVC 2015. Lecture Notes in Computer Science %C Haifa, Israel %Y Piterman N. %I Springer Verlag %V 9434 %P 39-50 %8 2015-11-17 %D 2015 %R 10.1007/978-3-319-26287-1_3 %K Software testing %K Static analysis %K Verification %K Flinder %K Fuzzing %K Heartbleed %K Program slicing %K Vulnerability detection %K C (programming language) %Z Computer Science [cs]Conference papers %X Security of modern information and communication systems has become a major concern. This tool paper presents Flinder-SCA, an original combined tool for vulnerability detection, implemented on top of Frama-C, a platform for collaborative verification of C programs, and Search Lab’s Flinder testing tool. Flinder-SCA includes three steps. First, abstract interpretation and taint analysis are used to detect potential vulnerabilities (alarms), then program slicing is applied to reduce the initial program, and finally a testing step tries to confirm detected alarms by fuzzing on the reduced program. We describe the proposed approach and the tool, illustrate its application for the recent OpenSSL/HeartBeat Heartbleed vulnerability, and discuss the benefits and industrial application perspectives of the proposed verification approach. %G English %L cea-01834981 %U https://cea.hal.science/cea-01834981 %~ CEA %~ DRT %~ CEA-UPSAY %~ UNIV-PARIS-SACLAY %~ CEA-UPSAY-SACLAY %~ LIST %~ GS-COMPUTER-SCIENCE