Fuzzing for Information Leakage

我的论文计划是将模糊测试的系统测试技术应用到信息泄漏领域。与我的主要导师大卫·克拉克博士一起，我们设计了一个大致的计划来实现这个目标。以下部分描述了我计划如何在未来3年集中我的研究，分为三个不同的阶段：利用模糊测试检测信息泄漏（10个月）首先，我计划研究和开发一种将模糊测试应用于信息泄漏搜索任务的技术。我最初的想法是使用超测试。在这种情况下，超测试指的是具有匹配的低安全性输入但不同的高安全性输入的测试对。fuzzing传统上使用常规测试，所以我要么需要修改现有的fuzzer，要么需要编写一个新的fuzzer来生成超测试。我目前参加了一个研究小组，正在研究信息泄漏的自动修复，我们最近在ASE 2021上发表了一篇简短的论文——HyperGI：信息流泄漏的自动检测和修复——记录了一种基于遗传改进的修复方法。为了评估候选修复的适应度，需要对信息泄漏进行近似度量，为此对候选修复运行一组超测试。目前，超测试是使用启发式方法生成的，这种方法对已知的泄漏很有效，但是基于模糊测试的方法肯定会改进系统。我在第一年的个人项目中所做的工作也将有助于生成更多样化的测试集，从而改进系统的功能测试。使用模糊测试测量信息泄漏（10个月）与检测信息泄漏是一个微妙的不同问题，测量信息泄漏更依赖于信息论。准确测量信息泄漏（也被称为量化信息流- QIF -在文献中）是困难的，实际上对于大输入空间或非常复杂的程序都是不可行的。有一些旧的工作使用统计来代替估计高安全性机密和低安全性可观察对象之间的相互信息的边界，从而产生对信息泄漏的估计。这项工作依赖于生成随机输入，并且概念证明只适用于小的整数程序。最近，那些研究机器学习的人对互信息的估计感兴趣，因为它对特征选择直接有用。扩展旧的信息泄漏特定工作，或最近的机器学习工作，我应该能够扩展泄漏检测技术，也测量所述泄漏的数量。改进信息泄漏的模糊测试（10个月）有许多有趣的技术可能被证明对帮助搜索泄漏有用；首先，我第一年项目所基于的概念，增加了生成测试的输入多样性。我可以研究一种基于语法的模糊测试方法。或者，我可以应用MarcelBoehme关于成本估算和/或覆盖熵（对具有罕见覆盖属性的输入进行模糊排序）的一些想法来改进技术。我应该探索尽可能多的想法，这应该是可能的，考虑到我在评估信息泄漏模糊化的有效性方面的经验，这个初步计划留出了时间，以便在有用的时候进一步审查具体的相关文献（而不是在博士开始时预算一个块）。还会留出时间将作品格式化成论文。

The plan for my thesis is to apply the system testing technique of fuzzing to the domain of informationleakage. Working with my primary supervisor Dr David Clark, we have devised a rough plan to worktoward this. The following sections describe how I plan to focus my research over the coming 3 years,split into three distinct stages:i. Detecting Information Leakage using Fuzzing (10 Months)Firstly, I plan to research and develop a technique for applying fuzzers to the task of searching forinformation leakage. My initial idea for this proposes using hypertesting. Hypertesting in this casereferring to pairs of tests with matching low security inputs, but differing high security inputs. Fuzzingtraditionally uses regular testing, so I will either need to modify an existing fuzzer or write a new fuzzer inorder to generate hypertests.I currently participate in a research group that is investigating automated repair of information leakage,and we have recently had a short paper accepted to ASE 2021 - HyperGI: Automated Detection andRepair of Information Flow Leakage - documenting a genetic improvement based approach to repair. Inorder to evaluate the fitness of candidate repairs, an approximate measure of information leakage isrequired, and for this a set of hypertests are ran against the candidate. Currently the hypertests aregenerated using a heuristic, which works well for known leaks, however a fuzzing based approach wouldcertainly improve the system. The work that I have done in my first year individual project will also beuseful for generating more diverse test sets that can improve the functional testing of the system.ii. Measuring Information Leakage using Fuzzing (10 Months)A subtly distinct problem from detecting information leakage, measuring information leakage relies a littlemore heavily on information theory. Measuring information leakage (also known as quantified informationflow - QIF - in literature) exactly is difficult, and in fact infeasible for either large input spaces, or verycomplex programs. There is some older work using statistics to instead estimate a bound for the mutualinformation between high security secrets and low security observables, yielding an estimate for theinformation leakage. This work relied on generating random inputs, and the proof of concept worked onsmall, integer only programs. More recently, those researching machine learning have taken an interest inestimating mutual information, as it is directly useful for feature selection. Extending either the olderinformation leakage specific work, or the more recent machine learning work, I should be able to extendthe leakage detection technique to also measure the quantity of said leakage.iii. Improving Fuzzing for Information Leakage (10 Months)There are a number of interesting techniques that may prove to be useful in aiding the search for leakage;as a start, the concept that my first year project has been based on, which increases the input diversity ofgenerated tests. I could look into a grammar based fuzzing approach. Or I could apply some of MarcelBoehme's ideas around cost estimation and / or coverage entropy (prioritising fuzzing of inputs with rarelyseen coverage properties) to improve the technique. I should explore as many ideas as possible, and thisshould be possible given the experience I will have at evaluating the effectiveness of fuzzing forinformation leakage by this pointThis initial plan leaves time for further review of specifically relevant literature at the time that it is useful(rather than budgeting a single block at the beginning of the PhD). There is also time set aside forformatting the work into a thesis.