检索结果-内蒙古大学图书馆

Tracking Dependent Information Flows 3

3rd International Conference on Information Systems Security and Privacy (ICISSP) / International Conference on Security and Cryptography (SECRYPT)

作者： Zhioua, Zeineb Roudier, Yves Ameur, Rabea Boulifa Kechiche, Takoua Short, Stuart EURECOM SAP Labs France Mougins France Univ Nice Sophia Antipolis CNRS I3S Biot France Telecom ParisTech Biot France SAP Labs France Mougins France

ISBN: (纸本)9789897582097

Ensuring the compliance of developed software with security requirements is a challenging task due to imprecision on the security guidelines definition, and to the lack of automatic and formal means to lead this verification. In this paper, we present our approach that aims at integrating the formal specification and verification of security guidelines in early stages of the development life cycle by combining the model checking together with information flow analysis. We formally specify security guidelines that involve dependent information flows as a basis to lead formal verification through model checking, and provide precise feedback to the developer.

关键词： Security Guidelines Formal Specification Model Checking Information Flow Analysis program dependence graph Labeled Transition System

来源：评论

学校读者我要写书评

暂无评论

CCSharp: An Efficient Three-phase Code Clone Detector Using Modified PDGs 24

CCSharp: An Efficient Three-phase Code Clone Detector Using ...

引用

24th Asia-Pacific Software Engineering Conference (APSEC)

作者： Wang, Min Wang, Pengcheng Xu, Yun Univ Sci & Technol China Sch Comp Sci Hefei 230027 Anhui Peoples R China Natl Univ Def Technol Lab High Performance Comp Anhui Prov Changsha 410073 Hunan Peoples R China Natl Univ Def Technol Collaborat Innovat Ctr High Performance Comp Changsha 410073 Hunan Peoples R China

ISBN: (纸本)9781538636817

Detecting code clones in software systems is becoming more and more important with the blossom of open source projects. In spite of numerous active researches, there is still a lack of detecting clones especially high-level clones efficiently and accurately. In this paper, we present CCSharp, a three-phase PDG-based clone detector which can detect much more clones besides high-level ones in software systems. To solve the problem of PDG-based tool's high time cost, we adopt two strategies to decrease the overall computing quantity of our tool: PDG's structure modification and characteristic vector filtering. In PDG's structure modification, we propose a novel technique to merge procedure invocation nodes which can make clone detection get rid of influence of procedure's parameters and disguise as well as downscale PDG's structure. We proceed clone detection on both real-world and artificial codebase by CCSharp along with other three state-of-the-art tools. Experiment results show that CCSharp has both high recall and precision, and can detect much more unique clones compared with the other three tools.

关键词： code clone detection program dependence graph PDG modification characteristic vector filtering

来源：评论

学校读者我要写书评

暂无评论

A Collaborative dependence Analysis Framework

A Collaborative Dependence Analysis Framework

引用

IEEE/ACM International Symposium on Code Generation and Optimization (CGO)

作者： Johnson, Nick P. Fix, Jordan Beard, Stephen R. Oh, Taewook Jablin, Thomas B. August, David I. Princeton Univ Princeton NJ 08544 USA UIUC Multicoreware Princeton NJ USA

ISBN: (纸本)9781509049318

Compiler optimizations discover facts about program behavior by querying static analysis. However, developing or extending precise analysis is difficult. Some prior works implement analysis with a single algorithm, but the algorithm becomes more complex as it is extended for greater precision. Other works achieve modularity by implementing several simple algorithms and trivially composing them to report the best result from among them. Such a modular approach has limited precision because it employs only one algorithm in response to one query, without synergy between algorithms. This paper presents a framework for dependence analysis algorithms to collaborate and achieve precision greater than the trivial combination of those algorithms. With this framework, developers can achieve the high precision of complex analysis algorithms through collaboration of simple and orthogonal algorithms, without sacrificing the ease of implementation of the modular approach. Results demonstrate that collaboration of simple analyses enables advanced compiler optimizations.

关键词： Collaborative analysis Demand-driven analysis dependence analysis program dependence graph

来源：评论

学校读者我要写书评

暂无评论

Security-by-construction in web applications development via database annotations

引用

COMPUTERS & SECURITY 2016年 59卷 151-165页

作者： El-Hajj, Wassim Ben Brahim, Ghassen Hajj, Hazem Safa, Haidar Adaimy, Ralph Amer Univ Beirut Dept Comp Sci Beirut Lebanon Prince Mohammad Bin Fahd Univ Dept Comp Sci Riyadh Saudi Arabia Amer Univ Beirut Dept Elect & Comp Engn Beirut Lebanon

Huge amounts of data and personal information are being sent to and retrieved from web applications on daily basis. Every application has its own confidentiality and integrity policies. Violating these policies can have broad negative impact on the involved company's financial status, while enforcing them is very hard even for the developers with good security background. In this paper, we propose a framework that enforces security-by construction in web applications. Minimal developer effort is required, in a sense that the developer only needs to annotate database attributes by a security class. The web application code is then converted into an intermediary representation, called Extended program dependence graph (EPDG). Using the EPDG, the provided annotations are propagated to the application code and run against generic security enforcement rules that were carefully designed to detect insecure information flows as early as they occur. As a result, any violation in the data's confidentiality or integrity policies is reported. As a proof of concept, two PHP web applications, Hotel Reservation and Auction, were used for testing and validation. The proposed system was able to catch all the existing insecure information flows at their source. Apart from the proof of concept and to comprehensively test the performance of our system, we compared it to JLift, a state-of-the-art type-based system approach to detect information leaks. Both approaches were run against custom made PHP web applications and publicly available applications downloaded from SourceForge and GitHub. The results show that our approach outperforms JLift in terms of accuracy and the number of false alarms, and is able to catch the insecure flows at their source when they first occurred. (C) 2016 Elsevier Ltd. All rights reserved.

关键词： Web applications security Secure information flow program dependence graph Database annotation Security by construction

来源：评论

学校读者我要写书评

暂无评论

Measuring Source Code Similarity by Finding Similar Subgraph with an Incremental Genetic Algorithm 16

Measuring Source Code Similarity by Finding Similar Subgraph...

引用

Genetic and Evolutionary Computation Conference (GECCO)

作者： Kim, Jinhyun Choi, HyukGeun Yun, Hansang Moon, Byung-Ro Seoul Natl Univ Sch Comp Sci & Engn 1 Gwanak Ro Seoul 151744 South Korea

ISBN: (纸本)9781450342063

Measuring similarity between source codes has lots of applications, such as code plagiarism detection, code clone detection, and malware detection. A variety of methods for the measurement have been developed and program-dependence-graph based methods are known to be well working against disguise techniques. But these methods usually rely on solving NP-hard problems which cause a scalability issue. In this paper, we propose a genetic algorithm to measure the similarity between two codes by solving an error correcting subgraph isomorphism problem on dependence graphs. We propose a new cost function for this problem, which reflects the characteristic of the source codes. An incremental genetic algorithm is used to solve the problem. The size of the graph to be searched is gradually increasing during the evolutionary process. We developed new operators for the algorithm, and the overall system is tested on some real world data. Experimental results showed that the system successfully works on code plagiarism detection and malware detection. The similarity computed by the system turned out to reflect the similarity between the codes properly.

关键词： Code similarity subgraph isomorphism problem incremental genetic algorithm program dependence graph

来源：评论

学校读者我要写书评

暂无评论

Exploring and Enforcing Security Guarantees via program dependence graphs 15

Exploring and Enforcing Security Guarantees via Program Depe...

引用

36th ACM SIGPLAN Conference on programming Language Design and Implementation

作者： Johnson, Andrew Waye, Lucas Moore, Scott Chong, Stephen MIT Lincoln Lab Cambridge MA 02139 USA Harvard Univ Cambridge MA 02138 USA

ISBN: (纸本)9781450334686

We present PIDGIN, a program analysis and understanding tool that enables the specification and enforcement of precise application-specific information security guarantees. PIDGIN also allows developers to interactively explore the information flows in their applications to develop policies and investigate counter-examples. PIDGIN combines program dependence graphs (PDGs), which precisely capture the information flows in a whole application, with a custom PDG query language. Queries express properties about the paths in the PDG;because paths in the PDG correspond to information flows in the application, queries can be used to specify global security policies. PIDGIN is scalable. Generating a PDG for a 330k line Java application takes 90 seconds, and checking a policy on that PDG takes under 14 seconds. The query language is expressive, supporting a large class of precise, application-specific security guarantees. Policies are separate from the code and do not interfere with testing or development, and can be used for security regression testing. We describe the design and implementation of PIDGIN and report on using it: (1) to explore information security guarantees in legacy programs;(2) to develop and modify security policies concurrently with application development;and (3) to develop policies based on known vulnerabilities.

关键词： Application-specific security program dependence graph graph query language

来源：评论

学校读者我要写书评

暂无评论

RELIABILITY ANALYSIS OF TEST CASES FOR program SLICING 1

RELIABILITY ANALYSIS OF TEST CASES FOR PROGRAM SLICING

引用

1st International Conference on Innovation and Challenges in Cyber Security (ICICCS)

作者： Negi, Gaurav Elias, Eldo Kohli, Rashi Bibhu, Vimal Dr APJ AKTU CSE Dept Lucknow Uttar Pradesh India Amity Univ CSE Dept Greater Noida India

ISBN: (纸本)9781509020843

The concept used in the research paper includes program slicing which is referred as the process of computing the chosen set of instructions of the program, The slicing criterion refers to the slice that is likely to affect the values at some point while executing the program. The paper highlights the different test cases and comparative analysis of program slicing methods which corresponds to the applications which are usually utilized in software modification activities i.e. Debugging process, testing analysis and its phases, calculating complexity and program understanding etc. In the approach used in the paper the "slicing" method of the program focus on precise & definedsub-components of a program;which can further be used to produce the instructions needed for the program, relevant to an explicit method of computation. Applying slicing techniques to software's using slicing tools, we can determine which components can be facilitated and reused. The process of designing phase of and the reused patterns are likely to suggest improvement in the respective code.

关键词： Control flow graph Dynamic slicing program dependence graph program slicing Static slicing Test cases

来源：评论

学校读者我要写书评

暂无评论

A Survey of Loop Parallelization: Models, Approaches, and Recent Developments

引用

INTERNATIONAL JOURNAL OF GRID AND DISTRIBUTED COMPUTING 2016年第11期9卷 143-156页

作者： Yao, Hong Deng, Huifang Zou, Caifeng South China Univ Technol Sch Comp Sci & Engn Guangzhou 510006 Guangdong Peoples R China

In cloud computing era, automatic parallelization is still significant for virtualization platform. However, after several decades of development, the overall effect is still to be improved. Summary of the mainstream technology developments will be beneficial to reveal the future direction and trend. This paper reviews the technology of loop parallelization, which is the key issue in automatic parallelization. After introducing the basic models and approaches, we focus on the recent developments, on which we obtain the trend of this field and the conclusions about future.

关键词： Automatic parallelization Loop parallelization Loop transformation Data dependence Polyhedral model program dependence graph

来源：评论

学校读者我要写书评

暂无评论

dependence-driven delimited CPS transformation for JavaScript

引用

ACM SIGPLAN Notices 2016年第3期52卷 59-69页

作者： Philips, Laure De Koster, Joeri De Meuter, Wolfgang De Roover, Coen Software Languages Lab Vrije Universiteit Brussel Belgium

In today's web applications asynchronous requests to remote services using callbacks or futures are omnipresent. The continuation of such a non-blocking task is represented as a callback function that will later be called with the result of the request. This style of programming where the remainder of a computation is captured in a continuation function is called continuation-passing style (CPS). This style of programming can quickly lead to a phenomenon called "call- back hell", which has a negative impact on the maintain- ability of applications that employ this style. Several alter- natives to callbacks are therefore gaining traction within the web domain. For example, there are a number of frameworks that rely on automatically transforming sequential style code into the continuation-passing style. However, these frame- works often employ a conservative approach in which each function call is transformed into CPS. This conservative approach can sequentialise requests that could otherwise be run in parallel. So-called delimited continuations can remedy, but require special marks that have to be manually inserted in the code for marking the beginning and end of the continuation. In this paper we propose an alternative strategy in which we apply a delimited CPS transformation that operates on a program dependence graph instead to find the limits of each *** implement this strategy in JavaScript and demonstrate its applicability to various web programming scenarios. © 2016 ACM.

关键词： CPS transformation JavaScript program dependence graph

来源：评论

学校读者我要写书评

暂无评论

A new algorithm for low-deterministic security

引用

INTERNATIONAL JOURNAL OF INFORMATION SECURITY 2015年第3期14卷 263-287页

作者： Giffhorn, Dennis Snelting, Gregor Karlsruhe Inst Technol D-76021 Karlsruhe Germany

We present a new algorithm for checking probabilistic noninterference in concurrent programs. The algorithm, named RLSOD, is based on the Low-Security Observational Determinism criterion. It utilizes program dependence graphs for concurrent programs and is flow-sensitive, context-sensitive, object-sensitive, and optionally time-sensitive. Due to a new definition of low-equivalency for infinite traces, the algorithm avoids restrictions or soundness leaks of previous approaches. A soundness proof is provided. Flow sensitivity turns out to be the key to precision and avoids prohibition of useful nondeterminism. The algorithm has been implemented for full Java byte code with unlimited threads. Precision and scalability have been experimentally validated.

关键词： Software security Noninterference program dependence graph Information flow control

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：