- author = "Ibrahim Mesecan and Daniel Blackwell and David Clark and Myra B. Cohen and Justyna Petke",
- title = "Keeping Secrets: Multi-objective Genetic Improvement forDetecting and Reducing Information Leakage",
- booktitle = "37th IEEE/ACM International Conference on Automated Software Engineering",
- year = "2022",
- editor = "Julia Rubin and Shahar Maoz and Marouane Kessentini",
- pages = "Article no. 61",
- address = "Oakland Center, Michigan, USA",
- month = "10-14 " # oct,
- keywords = "genetic algorithms, genetic programming, Genetic Improvement, SBSE, PyGGI, JMetalPy, Software and its engineering, Search-based software engineering, Security and privacy, Software security engineering, Information Leakage, Automated Program Repair, APR, Quantified Information Flow, QIF",
- isbn13 = "9781450394758",
-
URL = "
https://discovery.ucl.ac.uk/id/eprint/10152572/1/main.pdf",
-
DOI = "
doi:10.1145/3551349.3556947",
-
code_url = "
https://github.com/anonymous183459/LeakReducer/",
- size = "12 pages",
- abstract = "Information leaks in software can unintentionally reveal private data, yet they are hard to detect and fix. Although several methods have been proposed to detect leakage, such as static verification-based approaches, they require specialist knowledge, and are time-consuming. Recently, HyperGI introduced a dynamic, hypertest-based approach that detects and produces potential fixes for information leakage. Its fitness function tries to balance information leakage and program correctness, but there may be a tradeoff between keeping program semantics and reducing information leakage. we ask if it is possible to automatically detect and repair information leakage in more realistic programs without requiring specialist knowledge. Our approach, called LeakReducer explicitly encodes the tradeoff between program correctness and information leakage as a multi-objective optimisation problem. We apply LeakReducer to a set of leaky programs including the well known Heartbleed bug. It is comparable with HyperGI on toy applications. In addition, we demonstrate it can find and reduce leakage in real applications and we see diverse solutions on our Pareto front. Upon investigation we find that having a Pareto front helps with some types of information leakage, but not all.",
-
notes = "cites \cite{Clark:2021:ASE-NIER}.
Triangle, Atalk, Underflow, Classify, Heartbleed, Bignum https://heartbleed.com/
p2 'This suggests repairing information flow leakage should be viewed as a multi-objective problem' (ie 2 objectives reduce leakage versus retain functionality). OpenSSL. Hypertests.
p3 'program is deterministic' 'some flakiness in hypertests is tolerable' 'agnostic about the entropy in the high(secret) part of states'
p4 AFL++ fuzz testing HashFuzz, manual seed (Test Augmentation). sec 3.2 Automated Hypertest Generation eh?
p5 Leak Localization. NewIf NewFor tagged XML, Universal Ctags https://ctags.io/ Compare against HyperGI \cite{Clark:2021:ASE-NIER}.
p6 https://cve.mitre.org/ AFL fuzzer address sanitizer, LLVM.
p8 SPEA2, MOCell, NSGAII, NSGAIII, SPEA2
Iowa State University, Ames, Iowa, USA
https://conf.researchr.org/home/ase-2022",
