Automatic Repair of Java Code with Timing Side-Channel Vulnerabilities

• Type: Article in International Conference Proceedings Book
• Date: 2021

Authors

Lima, R (Author) Other; Ferreira, JF (Author) Other; Mendes, A (Author) Other

Conference proceedings International

Title: 2021 36TH IEEE/ACM INTERNATIONAL CONFERENCE ON AUTOMATED SOFTWARE ENGINEERING WORKSHOPS (ASEW 2021)

Pages: 1-8

36th IEEE/ACM International Conference on Automated Software Engineering (ASE)

ELECTR NETWORK, NOV 15-19, 2021

Indexing

ISI Web of Knowledge - 0 Citations

Scopus - 0 Citations

Other information

Authenticus ID: P-00W-2KV

DOI: 10.1109/asew52652.2021.00014

Abstract (EN): Vulnerability detection and repair is a demanding and expensive part of the software development process. As such, there has been an effort to develop new and better ways to automatically detect and repair vulnerabilities. DifFuzz is a state-of-the-art tool for automatic detection of timing side-channel vulnerabilities, a type of vulnerability that is particularly difficult to detect and correct. Despite recent progress made with tools such as DifFuzz, work on tools capable of automatically repairing timing side-channel vulnerabilities is scarce. In this paper, we propose DifFuzzAR, a new tool for automatic repair of timing side-channel vulnerabilities in Java code. The tool works in conjunction with DifFuzz and it is able to repair 56% of the vulnerabilities identified in DifFuzz's dataset. The results show that the tool can indeed automatically correct timing side-channel vulnerabilities, being more effective with those that are controlflow based.

Language: English

Type (Professor's evaluation): Scientific

No. of pages: 8