Keeping Secrets: Multi-objective Genetic Improvement for Detecting and Reducing Information Leakage
Keeping Secrets: Multi-objective Genetic Improvement for Detecting and Reducing Information Leakage
复制标题
保守秘密：用于检测和减少信息泄露的多目标遗传改进
DOI：
10.1145/3551349.3556947
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Petke, Justyna
中科院分区：
文献类型：
--
作者：
Mesecan, Ibrahim;Blackwell, Daniel;Clark, David;Cohen, Myra B.;Petke, Justyna
软件中的信息泄漏可能会无意中泄露私人数据，但它们很难检测和修复。尽管已经提出了几种方法来检测泄漏，例如基于静态验证的方法，但它们需要专业知识，并且耗时。最近，我们引入了HyperGI，这是一种动态的、基于hypertest的方法，可以检测和生成对hyperproperty违规的潜在修复。特别是，我们专注于违反不干扰属性，因为它会导致信息流泄漏。我们的HyperGI实例能够检测和减少三个小程序中的泄漏。它的健身功能试图平衡信息泄漏和程序的正确性，但正如我们指出的，可能会有保持程序语义和减少信息泄漏，需要开发人员decision.In这项工作中，我们问，如果它是可能的，自动检测和修复信息泄漏在更现实的程序，而不需要专业知识之间的权衡。我们在一个名为LeakReducer的工具中实例化了一个多目标版本的HyperGI，该工具明确地编码了程序正确性和信息泄漏之间的权衡。我们将LeakReducer应用于六个泄漏程序，包括众所周知的Heartbleed漏洞。LeakReducer能够检测所有泄漏，与最先进的模糊器相比，仅在两个程序中检测泄漏。此外，LeakReducer能够减少所有受试者的泄漏，其结果与以前的工作相当，同时可扩展到更大的软件。
Information leaks in software can unintentionally reveal private data, yet they are hard to detect and fix. Although several methods have been proposed to detect leakage, such as static verification-based approaches, they require specialist knowledge, and are time-consuming. Recently, we introduced HyperGI, a dynamic, hypertest-based approach that can detect and produce potential fixes for hyperproperty violations. In particular, we focused on violations of the noninterference property, as it results in information flow leakage. Our instantiation of HyperGI was able to detect and reduce leakage in three small programs. Its fitness function tried to balance information leakage and program correctness but, as we pointed out, there may be tradeoffs between keeping program semantics and reducing information leakage that require developer decisions.In this work we ask if it is possible to automatically detect and repair information leakage in more realistic programs without requiring specialist knowledge. We instantiate a multi-objective version of HyperGI in a tool, called LeakReducer, which explicitly encodes the tradeoff between program correctness and information leakage. We apply LeakReducer to six leaky programs, including the well-known Heartbleed bug. LeakReducer is able to detect leakage in all, in contrast to state-of-the-art fuzzers, detecting leakage in only two programs. Moreover, LeakReducer is able to reduce leakage in all subjects, with comparable results to previous work, while scaling to much larger software.
登录
查看更多内容
超级测试：超级属性的自动化测试案例
DOI：
10.1109/ase51524.2021.9678758
发表时间：
2015
期刊：
2021 36th IEEE/ACM International Conference on Automated Software Engineering (ASE)
影响因子：
--
作者：
Johannes Kinder
通讯作者：
Johannes Kinder
DOI：
10.1007/978-3-319-96131-6
发表时间：
2020
期刊：
The Science of Quantitative Information Flow
影响因子：
--
作者：
M. Alvim;K. Chatzikokolakis;Annabelle McIver;Carroll Morgan;C. Palamidessi;Geoffrey Smith
通讯作者：
Geoffrey Smith
影响因子：
1.2
作者：
Clark, David;Hunt, Sebastian;Malacaria, Pasquale
通讯作者：
Malacaria, Pasquale
DOI：
10.1109/icstw.2009.36
发表时间：
2009-04
期刊：
2009 International Conference on Software Testing, Verification, and Validation Workshops
影响因子：
--
作者：
Shuang Wang;A. Offutt
通讯作者：
Shuang Wang;A. Offutt
QFuzz：侧通道的定量模糊测试
DOI：
10.1145/3460319.3464817
发表时间：
2021
期刊：
Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis
影响因子：
--
作者：
Yannic Noller;Saeid Tizpaz
通讯作者：
Saeid Tizpaz