Mesecan, Ibrahim;
Blackwell, Daniel;
Clark, David;
Cohen, Myra B;
Petke, Justyna;
(2022)
Keeping Secrets: Multi-objective Genetic Improvement for Detecting and Reducing Information Leakage.
In:
ASE '22: Proceedings of the 37th IEEE/ACM International Conference on Automated Software Engineering.
Association for Computing Machinery (ACM): New York, NY, USA.
Preview |
Text
3551349.3556947.pdf Download (2MB) | Preview |
Abstract
Information leaks in software can unintentionally reveal private data, yet they are hard to detect and fix. Although several methods have been proposed to detect leakage, such as static verificationbased approaches, they require specialist knowledge, and are timeconsuming. Recently, HyperGI introduced a dynamic, hypertestbased approach that detects and produces potential fixes for information leakage. Its fitness function tries to balance information leakage and program correctness, but as the authors of that work point out, there may be a tradeoff between keeping program semantics and reducing information leakage. In this work we ask if it is possible to automatically detect and repair information leakage in more realistic programs without requiring specialist knowledge. Our approach, called LeakReducer explicitly encodes the tradeoff between program correctness and information leakage as a multi-objective optimisation problem. We apply LeakReducer to a set of leaky programs including the well known Heartbleed bug. It is comparable with HyperGI on their toy applications. In addition, we demonstrate it can find and reduce leakage in real applications and we see diverse solutions on our Pareto front. Upon investigation we find that having a Pareto front helps with some types of information leakage, but not all.
Type: | Proceedings paper |
---|---|
Title: | Keeping Secrets: Multi-objective Genetic Improvement for Detecting and Reducing Information Leakage |
Event: | ASE '22: 37th IEEE/ACM International Conference on Automated Software Engineering |
Open access status: | An open access version is available from UCL Discovery |
DOI: | 10.1145/3551349.3556947 |
Publisher version: | https://doi.org/10.1145/3551349.3556947 |
Language: | English |
Additional information: | This work is licensed under a Creative Commons Attribution International 4.0 licence (https://creativecommons.org/licenses/by/4.0/). |
Keywords: | Genetic Improvement, Information Leakage, Search-Based Software Engineering, Automated Program Repair |
UCL classification: | UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science UCL > Provost and Vice Provost Offices > UCL BEAMS > Faculty of Engineering Science > Dept of Computer Science UCL > Provost and Vice Provost Offices > UCL BEAMS UCL |
URI: | https://discovery.ucl.ac.uk/id/eprint/10152572 |
Archive Staff Only
![]() |
View Item |