The Role of Static Analysis in Hardening Open Source Intrusion Detection Systems

When deploying an open source Intrusion Detection System (IDS) into a network, it is critical to harden it against attackers. An IDS is designed to detect attacks instead of inadvertently enabling them. One approach to assist in this effort is to use static code analysis on the source code of the IDS. This paper details how to use Coverity's static analysis tools on the Security Onion distribution to find security vulnerabilities. A look at Coverity's security code checkers, with a focus toward UNINIT, BUFFER_SIZE, and USE_AFTER_FREE is discussed.