Confiance: detecting vulnerabilities in Java Card applets

This study focuses on automatically detecting wrong implementations of specifications in Java Card programs, without any knowledge on the source code or the specification itself. To achieve this, an approach based on Natural Language Processing and machine-learning is proposed. First, an oracle gathering methods with similar semantics in groups, is created. This focuses on evaluating our approach performances during the neighborhood discovery. Based on the groups of similar methods automatically retrieved, the anomaly detection relies on the Control Flow Graph of programs of these groups. In order to benchmark our approach's ability to detect vulnerabilities, an oracle of anomaly is created. This oracle knows every anomaly the approach should automatically retrieve. Both the neighborhood discovery and the anomaly detection steps are benchmarked. This approach is implemented in a tool: Confiance, and it is compared to another machine-learning tool for automatic vulnerability detection. The results expose the better performances of Confiance to detect vulnerabilities in open-source programs available online.