一句话：提出基于遗传改进的 HyperGI 框架，动态检测并定位信息流泄漏，并自动生成候选补丁修复泄漏。
软件保密信息控制长期面临挑战：一旦失效，秘密会通过程序行为泄漏。传统信息流控制技术多基于静态或符号分析，存在可扩展性差、绑定特定语言等问题；而当程序确实泄漏秘密时，除非泄漏导致功能性测试失败，否则缺乏自动修复手段。本文提出 HyperGI 的愿景：一个遗传改进（genetic improvement）框架，用于检测、定位并修复信息泄漏。其关键要素包括：（1）使用两个正交的测试套件；（2）动态泄漏检测方法，用于估计并定位潜在泄漏；（3）修复组件，借助遗传改进生成候选补丁。作者在多个没有失败功能测试用例的程序上成功演示了 HyperGI，并人工检查生成的补丁，识别其中的权衡以及实现完整愿景的未来方向。
Maintaining confidential information control in soft-ware is a persistent security problem where failure means secrets can be revealed via program behaviors. Information flow control techniques traditionally have been based on static or symbolic analyses — limited in scalability and specialized to particular languages. When programs do leak secrets there are no approaches to automatically repair them unless the leak causes a functional test to fail. We present our vision for HyperGI, a genetic improvement framework that detects, localizes and repairs information leakage. Key elements of HyperGI include (1) the use of two orthogonal test suites, (2) a dynamic leak detection approach which estimates and localizes potential leaks, and (3) a repair component that produces a candidate patch using genetic improvement. We demonstrate the successful use of HyperGI on several programs with no failing functional test cases. We manually examine the resulting patches and identify trade-offs and future directions for fully realizing our vision.
DOI 原文 ·
@inproceedings{paperbot6484,
title = {HyperGI: Automated Detection and Repair of Information Flow Leakage},
author = {Ibrahim Mesecan and Daniel Blackwell and David Clark and Myra B. Cohen and Justyna Petke},
booktitle = {ASE},
year = {2021},
doi = {10.1109/ase51524.2021.9678758}
}