检索结果-内蒙古大学图书馆

2nd International Doctoral Symposium on Applied Computation and Security Systems (ACSS)

作者： Rani, Sapana Kachhap, Preeti Halder, Raju Indian Inst Technol Patna Bihar India

ISBN: (纸本)9788132226536;9788132226512

In this paper, we propose a persistent watermarking technique of information systems supported by relational databases at the back-end. The persistency is achieved by identifying an invariant part of the database which remains unchanged w.r.t. the operations in the associated applications. To achieve this, we apply static data-flow analysis technique to the applications. The watermark is then embedded into the invariant part of the database, leading to a persistent watermark. We also watermark the associated applications in the information system by using opaque predicates which are obtained from the variant part of the database.

关键词： Persistent watermarking Relational databases data-flow analysis Security

来源：评论

学校读者我要写书评

暂无评论

CRYPTODY: Cryptographic Misuse analysis of IoT Firmware via data-flow Reasoning 24

CRYPTODY: Cryptographic Misuse Analysis of IoT Firmware via ...

引用

27th International Symposium on Research in Attacks, Intrusions and Defenses (RAID)

作者： Wang, Jianing Guo, Shanqing Diao, Wenrui Liu, Yue Duan, Haixin Liu, Yichen Liang, Zhenkai Natl Univ Singapore Singapore Singapore Shandong Univ Jinan Peoples R China Southeast Univ Nanjing Peoples R China QI ANXIN Grp Beijing Peoples R China Tsinghua Univ Beijing Peoples R China Zhongguancun Lab Beijing Peoples R China Quancheng Lab Jinan Peoples R China Indiana Univ Bloomington Bloomington IN USA

ISBN: (纸本)9798400709593

Cryptographic techniques form the foundation of the security and privacy of computing solutions. However, if cryptographic APIs are not invoked correctly, they can result in significant security problems. In this paper, we abstract the intricate crypto misuse detection problem as a data-flow reasoning task. Towards this end, we propose CrypTody, a novel logic-inference-based framework for detecting crypto misuses via reasoning about data flows on multi-architecture IoT firmware images. It carries out cross-architecture analysis, with detection strategies to reduce false positives and false negatives, such as cross-flow misuse inference. To evaluate the effectiveness of CrypTody, we conducted a large-scale experiment on 1,431 firmware images from 16 vendors. Our evaluation shows that 46% of the firmware images have high-risk misuses and 95% have at least one cryptographic misuse. In total, we find 6,624 potential crypto misuses, with 760 being cross-flow misuses that are not detected by existing solutions. We have responsibly disclosed portions of our findings to the relevant vendors. From the feedback, we note that CrypTody has a low false-positive rate for the confirmed misuses. Some typical cases have been assigned CVEs and fixed by the vendors.

关键词： Cryptographic misuse IoT firmware data-flow analysis

来源：评论

学校读者我要写书评

暂无评论

Exploring Sensor Usage Behaviors of Android Applications Based on data flow analysis 34

Exploring Sensor Usage Behaviors of Android Applications Bas...

引用

34th IEEE International Performance, Computing, and Communications Conference (lPCCC)

作者： Liu, Xing Liu, Jiqiang Wang, Wei Beijing Jiaotong Univ Sch Comp & Informat Technol Beijing 100044 Peoples R China

ISBN: (纸本)9781467385909

Today's Android-powered smartphones are equipped with various embedded sensors, such as the motion sensors, the environmental sensors and the position sensors. Many functions in the third-party applications (apps) need to use these sensors. However, embedded sensors may lead to security issues, as the third-party apps can access data from these sensors without claiming any permissions. It has been proven that embedded sensors can be exploited by well designed malicious apps, resulting in leaking users' privacy. In this work, we are motivated to provide an up-to-date overview of sensor usage patterns in current apps by investigating what, why and how embedded sensors are used in all the apps collected from a complete app market. To fulfill this goal, We develop a tool called "SDFDroid" to identify the sensors' types and to generate the sensor data propagation paths in each app. We then cluster the apps to find out their sensor usage patterns based on their sensor data propagation paths. We apply our method on AppChina, a widely used Chinese Android app market. Extensive experiments are conducted and the experimental results show that most apps implement their sensor related functions by using the third-party libraries. We further study the sensor usage in the third-party libraries. Our results show the accelerometer sensor is the most frequently used sensor. Though many third-party libraries use no more than four types of sensors, there are some third-party libraries register all the types of sensors recklessly. These results show the need for better regulating the sensor usage in Android apps.

关键词： Android system Sensor usage data-flow analysis Clustering

来源：评论

学校读者我要写书评

暂无评论

An Incremental Algorithm for Algebraic Program analysis

引用

PROCEEDINGS OF THE ACM ON PROGRAMMING LANGUAGES-PACMPL 2025年第POPL期9卷 1934-1961页

作者： Zhou, Chenyu Fang, Yuzhou Wang, Jingbo Wang, Chao Univ Southern Calif Los Angeles CA 90007 USA Purdue Univ W Lafayette IN USA

We propose a method for conducting algebraic program analysis (APA) incrementally in response to changes of the program under analysis. APA is a program analysis paradigm that consists of two distinct steps: computing a path expression that succinctly summarizes the set of program paths of interest, and interpreting the path expression using a properly-defined semantic algebra to obtain program properties of interest. In this context, the goal of an incremental algorithm is to reduce the analysis time by leveraging the intermediate results computed before the program changes. We have made two main contributions. First, we propose a data structure for efficiently representing path expression as a tree together with a tree-based interpreting method. Second, we propose techniques for efficiently updating the program properties in response to changes of the path expression. We have implemented our method and evaluated it on thirteen Java applications from the DaCapo benchmark suite. The experimental results show that both our method for incrementally computing path expression and our method for incrementally interpreting path expression are effective in speeding up the analysis. Compared to the baseline APA and two state-of-the-art APA methods, the speedup of our method ranges from 160x to 4761x depending on the types of program analyses performed.

关键词： Algebraic Program analysis data-flow analysis Side-channel analysis Incremental Algorithm

来源：评论

学校读者我要写书评

暂无评论

Augmenting Interpolation-Based Model Checking with Auxiliary Invariants 30th

Augmenting Interpolation-Based Model Checking with Auxiliary...

引用

30th International Symposium on Model Checking Software

作者： Beyer, Dirk Chien, Po-Chun Lee, Nian-Ze Ludwig Maximilians Univ Munchen Munich Germany

ISBN: (纸本)9783031661488;9783031661495

Software model checking is a challenging problem, and generating relevant invariants is a key factor in proving the safety properties of a program. Program invariants can be obtained by various approaches, including lightweight procedures based on data-flow analysis and intensive techniques using Craig interpolation. Although data-flow analysis runs efficiently, it often produces invariants that are too weak to prove the properties. By contrast, interpolation-based approaches build strong invariants from interpolants, but they might not scale well due to expensive interpolation procedures. Invariants can also be injected into model-checking algorithms to assist the analysis. Invariant injection has been studied for many well-known approaches, including k-induction, predicate abstraction, and symbolic execution. We propose an augmented interpolation-based verification algorithm that injects external invariants into interpolation-based model checking (McMillan, 2003), a hardware model-checking algorithm recently adopted for software verification. The auxiliary invariants help prune unreachable states in Craig interpolants and confine the analysis to the reachable parts of a program. We implemented the proposed technique in the verification framework CPACHECKER and evaluated it against mature SMT-based methods in CPACHECKER as well as other state-of-the-art software verifiers. We found that injecting invariants reduces the number of interpolation queries needed to prove safety properties and improves the run-time efficiency. Consequently, the proposed invariant-injection approach verified difficult tasks that none of its plain version (i.e., without invariants), the invariant generator, or any compared tools could solve.

关键词： Software model checking Program invariants Invariant injection Craig interpolation data-flow analysis SMT SAT

来源：评论

学校读者我要写书评

暂无评论

Exploiting the Sparseness of Control-flow and Call Graphs for Efficient and On-Demand Algebraic Program analysis

引用

PROCEEDINGS OF THE ACM ON PROGRAMMING LANGUAGES-PACMPL 2023年第OOPSLA期7卷 1993–2022页

作者： Conrado, Giovanna Kobus Goharshady, Amir Kafshdar Kochekov, Kerim Tsai, Yun Chen Zaher, Ahmed Khaled Hong Kong Univ Sci & Technol Dept Comp Sci & Engn Dept Math Clear Water Bay Hong Kong Peoples R China

Algebraic Program analysis (APA) is a ubiquitous framework that has been employed as a unifying model for various problems in data-flow analysis, termination analysis, invariant generation, predicate abstraction and a wide variety of other standard static analysis tasks. APA models program summaries as elements of a regular algebra (A, circle plus, circle times, circle star, (o) over bar, (1) over bar). Suppose that a summary in A is assigned to every transition of the program and that we aim to compute the effect of running the program starting at line s and ending at line t. APA first computes a regular expression rho capturing all program paths of interest. In case of intraprocedural analysis, rho models all paths from s to t, whereas in the interprocedural case it models all interprocedurally-valid paths, i.e. paths that go back to the right caller function when a callee returns. This regular expression rho is then interpreted over the algebra (A, circle plus, circle times, circle star, (o) over bar, (1) over bar) to obtain the desired result. Suppose the program has n lines of code and each evaluation of an operation in the regular algebra takes O(k) time. It is well-known that a single APA query, or a set of queries with the same starting point B, can be answered in O (n . alpha(n) . k), where alpha is the inverse Ackermann function. In this work, we consider an on-demand setting for APA: the program is given in the input and can be preprocessed. The analysis has to then answer a large number of on-line queries, each providing a pair (s, t) of program lines which are the start and end point of the query, respectively. The goal is to avoid the significant cost of running a fresh APA instance for each query. Our main contribution is a series of algorithms that, after a lightweight preprocessing of O(n . lg n . k), answer each query in O(k) time. In other words, our preprocessing has almost the same asymptotic complexity as a single APA query, except for a sub-lo

关键词： Algebaric Program analysis Parameterized Algorithms Graph Sparsity Treewidth Treedepth data-flow analysis

来源：评论

学校读者我要写书评

暂无评论

Screen-Printed Technologies Combined with flow analysis Techniques: Moving from Benchtop to Everywhere

引用

ANALYTICAL CHEMISTRY 2022年第1期94卷 250-268页

作者： Barros Azeredo, Nathalia Florencia Ferreira Santos, Mauro S. Sempionatto, Juliane R. Wang, Joseph Angnes, Lucio Univ Sao Paulo Inst Chem BR-05508070 Sao Paulo Brazil CALTECH NASA Jet Prop Lab Pasadena CA 91109 USA Univ Calif San Diego Dept Nanoengn La Jolla CA 92093 USA

Screen-printed electrodes (SPEs) coupled with flow systems have been reported in recent decades for an evergrowing number of applications in modern electroanalysis, aiming for portable methodologies. The information acquired through this combination can be attractive for future users with basic knowledge, especially due to the increased measurement throughput, reduction in reagent consumption and minimal waste generation. The trends and possibilities of this set rely on the synergistic behavior that maximizes both SPE and flow analyses characteristics, allowing mass production and automation. This overview addresses an in-depth update about the scope of samples, target analytes, and analytical throughput (injections per hour, limits of detection, linear range, etc.) obtained by coupling injection techniques (FIA, SIA, and BIA) with SPE-based electrochemical detection.

关键词： data-flow analysis Screen printing Linear range Screen-printed electrodes

来源：评论

学校读者我要写书评

暂无评论

A Framework for Memory Efficient Context-Sensitive Program analysis

引用

THEORY OF COMPUTING SYSTEMS 2022年第5期66卷 911-956页

作者： Hedenborg, Mathias Lundberg, Jonas Lowe, Welf Trapp, Martin Linnaeus Univ Vaxjo Sweden Senacor Technol AG Nurnberg Germany

Static program analysis is in general more precise if it is sensitive to execution contexts (execution paths). But then it is also more expensive in terms of memory consumption. For languages with conditions and iterations, the number of contexts grows exponentially with the program size. This problem is not just a theoretical issue. Several papers evaluating inter-procedural context-sensitive data-flow analysis report severe memory problems, and the path-explosion problem is a major issue in program verification and model checking. In this paper we propose chi-terms as a means to capture and manipulate context-sensitive program information in a data-flow analysis. chi-terms are implemented as directed acyclic graphs without any redundant subgraphs. We introduce the k-approximation and the l-loop-approximation that limit the size of the context-sensitive information at the cost of analysis precision. We prove that every context-insensitive data-flow analysis has a corresponding k,l-approximated context-sensitive analysis, and that these analyses are sound and guaranteed to reach a fixed point. We also present detailed algorithms outlining a compact, redundancy-free, and DAG-based implementation of chi-terms.

关键词： Static program analysis data-flow analysis Context-sensitivity

来源：评论

学校读者我要写书评

暂无评论

Explaining Static analysis With Rule Graphs

引用

IEEE TRANSACTIONS ON SOFTWARE ENGINEERING 2022年第2期48卷 678-690页

作者： Do, Lisa Nguyen Quang Bodden, Eric Paderborn Univ D-33098 Paderborn Germany Fraunhofer IEM D-33098 Paderborn Germany

As static data-flow analysis becomes able to report increasingly complex bugs, using an evergrowing set of complex internal rules encoded into flow functions, the analysis tools themselves grow more and more complex. In result, for users to be able to effectively use those tools on specific codebases, they require special configurations-a task which in industry is typically performed by individual developers or dedicated teams. To efficiently use and configure static analysis tools, developers need to build a certain understanding of the analysis' rules, i.e., how the underlying analyses interpret the analyzed code and their reasoning for reporting certain warnings. In this article, we explore how to assist developers in understanding the analysis' warnings, and finding weaknesses in the analysis' rules. To this end, we introduce the concept of rule graphs that expose to the developer selected information about the internal rules of data-flow analyses. We have implemented rule graphs on top of a taint analysis, and show how the graphs can support the abovementioned tasks. Our user study and empirical evaluation show that using rule graphs helps developers understand analysis warnings more accurately than using simple warning traces, and that rule graphs can help developers identify causes for false positives in analysis rules.

关键词： Static analysis Tools SQL injection Task analysis Computer bugs Cognition Usability Program analysis data-flow analysis rule graphs analysis configuration explainability usability

来源：评论

学校读者我要写书评

暂无评论

Context-Sensitive Meta-Constraint Systems for Explainable Program analysis 29th

Context-Sensitive Meta-Constraint Systems for Explainable Pr...

引用

29th International Conference on Tools and Algorithms for the Construction and analysis of Systems (TACAS)

作者： Apinis, Kalmer Vojdani, Vesal Univ Tartu Inst Comp Sci Narva Mnt 18 EE-51009 Tartu Estonia

ISBN: (纸本)9783031308192;9783031308208

We show how to generate a constraint system of symbolic expressions as part of an inter-procedural constraint-system-based program analysis such that any chosen slice of the intended analysis may be computed through the evaluation of the symbolic constraints. Thus, our method ensures that the computed expressions provide genuine explanations for the chosen analysis *** resulting system is then annotated with program location information, translated into closed-form expressions, and simplified to yield a human-readable justification for the analyzer's verdict. Justifications are given using program locations, constants from the program, abstract lattice operations, loops in the analysis, and computed results.

关键词： Program analysis data-flow analysis Constraint systems Abstract domains Explainability

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：