一句话：提出 ConstantGuard，用三级污点格、AST/CFG 语义检查与结构规则静态检测 C 代码时序侧信道风险。
时序侧信道漏洞源于秘密相关的控制流、内存访问与变时操作，是密码软件中的持续威胁。ConstantGuard 是面向 C 代码的静态分析器，用三级污点格建模污点传播，并结合 AST/CFG 语义检查与针对性结构规则识别风险。作者在 84 个函数的基准上评估：实例级 F1 为 69.66%，函数级准确率为 92.86%，较仅规则基线提升 14.57 个百分点。命名留出集在标识符重命名下 F1 无变化；外部留出集 F1 达 92.31%；吞吐超过 81,000 LOC/32 秒，且具近线性扩展。
Timing side-channel vulnerabilities stem from secret-dependent control flow, memory accesses, and variable-time operations, and remain a persistent threat in cryptographic software. We present ConstantGuard, a static analyzer for timing side-channel risks in C that combines a three-level taint lattice, AST/CFG semantic checks, and targeted structural rules. On an 84-function benchmark, Constant-Guard reaches 69.66% instance-level F1 and 92.86% function-level accuracy, exceeding a rule-only baseline by +14.57 pp. A naming holdout yields zero F1 delta under identifier renaming; an external holdout reaches 92.31% F1; and throughput exceeds 81,000 LOC in under 32 seconds with near-linear scaling.
@inproceedings{ZhangRLHT26,
title = {ConstantGuard: Lattice-Based Taint Analysis for Timing Side-Channel Risk Detection in C Code},
author = {Haoyi Zhang and Huaijin Ran and Tianfeng Liang and Md Maruf Hasan and Xunzhu Tang},
booktitle = {FSE},
year = {2026},
doi = {10.1145/3803437.3806671}
}