一句话：从漏洞数据库中挖掘信息泄漏修复补丁，归纳出10类可用于自动修复信息流控制违规的变异算子。
机密数据向未授权用户的非预期流动是严重的软件安全漏洞，其检测与修复十分困难。HyperGI 等动态方法结合超测试与遗传改进，不仅能检测信息流控制违规，还能生成减少违规的补丁，但已有实证研究多采用通用变异算子，可能限制了方法效果。本文是一篇新思想论文，作者挖掘美国国家漏洞数据库（NVD）以寻找信息泄漏的修复案例：在初步识别的 636 个问题中，找到 73 个与信息泄漏相关且附带开源代码补丁的修复，并据此归纳出 10 类有潜力修复此类问题的变异算子，其中 6 类此前从未被用于通过自动代码变异来修复信息泄漏。作者提出，这些算子有望提升采用 HyperGI 方法的工具的有效性。
The unintentional flow of confidential data to unauthorised users is a serious software security vulnerability. Detection and repair of such errors is a non-trivial task that has been worked on by the security community for many years. More recently, dynamic approaches, such as HyperGI, have been introduced that use hypertesting and genetic improvement to not only detect, but also provide a patch that reduces such information flow control violations. However, empirical studies performed so far have used mostly generic mutation operators, potentially limiting the strength of this approach. In this new ideas paper we mine the National Vulnerabilities Database to find repairs of information leaks. Of 636 issues initially identified, we found 73 fixes that relate to information leaks and come with open source patches to the code. From these, we identified 10 types of mutation operators with potential to fix such issues. Six of these have so far never been used to fix information leaks via automated mutation to the code. We propose that these could help improve effectiveness of tools using the HyperGI approach.
@inproceedings{paperbot8307,
title = {Mining for Mutation Operators for Reduction of Information Flow Control Violations},
author = {Ilya Kosorukov and Daniel Blackwell and David Clark and Myra B. Cohen and Justyna Petke},
booktitle = {ASE},
year = {2024},
doi = {10.1145/3691620.3695308}
}