- author = "Ibrahim Mesecan and Daniel Blackwell and David Clark and Myra B. Cohen and Justyna Petke",
- title = "{HyperGI}: Automated Detection and Repair of Information Flow Leakage",
- booktitle = "The 36th IEEE/ACM International Conference on Automated Software Engineering, New Ideas and Emerging Results track, ASE NIER 2021",
- year = "2021",
- editor = "Hourieh Khalajzadeh and Jean-Guy Schneider",
- pages = "1358--1362",
- address = "Melbourne",
- month = "15-19 " # nov,
- keywords = "genetic algorithms, genetic programming, genetic improvement, SBSE, APR, PyGGI 2, information flow leakage, Information Flow Control, IFC, Leak Localisation, noninterference security policy, Quantified Information Flow, QIF, Shannon Entropy",
- isbn13 = "978-1-6654-4784-3",
- eprint = "2108.12075",
-
URL = "
https://arxiv.org/abs/2108.12075",
-
URL = "
https://faculty.sites.iastate.edu/mcohen/files/inline-files/hyper-gi-2021.pdf",
-
URL = "https://discovery.ucl.ac.uk/id/eprint/10136860/",
-
DOI = "
doi:10.1109/ASE51524.2021.9678758",
- size = "5 pages",
- abstract = "Maintaining confidential information control in software is a persistent security problem where failure means secrets can be revealed via program behaviors. Information flow control techniques traditionally have been based on static or symbolic analyses, limited in scalability and specialized to particular languages. When programs do leak secrets there are no approaches to automatically repair them unless the leak causes a functional test to fail. We present our vision for HyperGI, a genetic improvement framework that detects, localises and repairs information leakage. Key elements of HyperGI include (1) the use of two orthogonal test suites, (2) a dynamic leak detection approach which estimates and localises potential leaks, and (3) a repair component that produces a candidate patch using genetic improvement. We demonstrate the successful use of HyperGI on several programs which have no failing functional tests. We manually examine the resulting patches and identify trade-offs and future directions for fully realising our vision",
-
notes = "See also \cite{Mesecan:2022:ASE}
Secret Triangle program (100 percent repair impossible). Apple Talk (atalk) CVE-2009-3002. Underflow (underflow) CVE-2007-2875. CVE vulnerability database.
Hypertesting is testing for hyperproperties. A hyperproperty can only be expressed as a property of more than one execution of a program.
'HyperGI is the use of two independent test suites, one used to test correct program semantics and a hypertest suite used to measure information leakage.'
'run fuzzers to gather functional tests'. 'generate hypertests;' 'run GP-based repair to try to decrease leakage' Compare with AFL and LibFuzzer.
Multiple GP runs (pop=32 gens=50)
'binary search strategy was able to detect leaks for all three programs', fuzzing did not.
in some 'cases our tests became flaky' (eg deleted return statement)
'HyperGI was able to find patches semantically-equivalent to developer fixes. It found patches reducing leakage in all three programs.'
Also known as \cite{mesecan2021hypergi}
Iowa State University, Ames, Iowa, USA
https://conf.researchr.org/track/ase-2021/ase-2021-nier-track",
