- author = "Ilya Kosorukov and Daniel Blackwell and David Clark and Myra Cohen and Justyna Petke",
- title = "Mining for Mutation Operators for Reduction of Information Flow Control Violations",
- booktitle = "IEEE/ACM International Conference on Automated Software Engineering, The New Ideas and Emerging Results (ASE-NIER 2024)",
- year = "2024",
- address = "Sacramento",
- month = "24 " # oct # " 27-" # nov # " 1",
- keywords = "genetic algorithms, genetic programming, Genetic Improvement, Information Leak Reduction, Information Leak Repair, insecure flows, IFC, NVD, CVE, LLM, ANN, LeakReducer, atalk, ChatGPT, Llama-3-70B-Instruct, LLM Prompt",
-
URL = "
https://discovery.ucl.ac.uk/id/eprint/10196237/",
-
URL = "
http://www.cs.ucl.ac.uk/staff/J.Petke/papers/Kosorukov_2024_ASENIER.pdf",
-
DOI = "
doi:10.1145/3691620.3695308",
-
data_url = "https://github.com/SOLAR-group/infoleakmining",
- size = "5 pages",
- abstract = "The unintentional flow of confidential data to unauthorised users is a serious software security vulnerability. Detection and repair of such errors is a non-trivial task that has been worked on by the security community for many years. More recently, dynamic approaches, such as HyperGI, have been introduced that use hypertesting and genetic improvement to not only detect, but also provide a patch that reduces such information flow control violations. However, empirical studies done so far have used mostly generic mutation operators, potentially limiting the strength of this approach. we mine the National Vulnerabilities Database to find repairs of information leaks. Of 636 issues initially identified, we found 73 fixes that relate to information leaks and come with open source patches to the code. From these, we identified 10 types of mutation operators with potential to fix such issues. Six of these have so far never been used to fix information leaks via automated mutation to the code. We propose that these could help improve effectiveness of tools using the HyperGI approach.",
-
notes = "atalk \cite{Mesecan:2022:ASE} p1 'Neither LLM could
identify the bug, let alone fix it'
appendix.pdf Table: A Possible(LeakReducer) StmtCopy StmtDelete VarReplace FuncCall VarAssign NewFunc NewFile Import NewIf NewFor. CVE-2022-4869 CVE-2022-46768 CVE-2022-41946 CVE-2022-4122 CVE-2022-40768 CVE-2022-39393 CVE-2022-39349 CVE-2022-39310 CVE-2022-39268 CVE-2022-35980 CVE-2022-3570 CVE-2022-2995 CVE-2022-2990 CVE-2022-2989 CVE-2022-29567 CVE-2022-29240 CVE-2022-28487 CVE-2022-26354 CVE-2022-26353 CVE-2022-25850 CVE-2022-24837 CVE-2022-24823 CVE-2022-23634 CVE-2022-23318 CVE-2022-23067 CVE-2022-21711 CVE-2022-21123 CVE-2022-1473 CVE-2022-0891 CVE-2022-0284 CVE-2022-0175 CVE-2021-45884 CVE-2021-45116 CVE-2021-41714 CVE-2021-41166 CVE-2021-38155 CVE-2021-3694 CVE-2021-36157 CVE-2021-3602 CVE-2021-34647 CVE-2021-3444 CVE-2021-32787 CVE-2021-32724 CVE-2021-32712 CVE-2021-31780 CVE-2021-29642 CVE-2021-28861 CVE-2021-28168 CVE-2021-22929 CVE-2021-22572 CVE-2021-22028 CVE-2021-21361 CVE-2021-21360 CVE-2021-21336 CVE-2021-21323 CVE-2021-21296 CVE-2021-21290 CVE-2020-5301 CVE-2020-5250 CVE-2020-4045 CVE-2020-3812 CVE-2020-29005 CVE-2020-2656 CVE-2020-25911 CVE-2020-15250 CVE-2020-15224 CVE-2020-14370 CVE-2020-14301 CVE-2020-13112 CVE-2020-11947 CVE-2020-10756 CVE-2020-10187 CVE-2020-0093 p3 '54 [of 73] vulnerabilities required more than one type of edit to produce a fix.'
p4 'New (python) Import.' (needed to support other parts of the patch?)",
