Automatic Repair of Java Code with Timing Side-Channel Vulnerabilities

• Tipo: Artigo em Livro de Atas de Conferência Internacional
• Data: 2021

Autores

Lima, R (Autor) Outra; Ferreira, JF (Autor) Outra; Mendes, A (Autor) Outra

Ata de Conferência Internacional

Título: 2021 36TH IEEE/ACM INTERNATIONAL CONFERENCE ON AUTOMATED SOFTWARE ENGINEERING WORKSHOPS (ASEW 2021)

Páginas: 1-8

36th IEEE/ACM International Conference on Automated Software Engineering (ASE)

ELECTR NETWORK, NOV 15-19, 2021

Indexação

ISI Web of Knowledge - 0 Citações

Scopus - 0 Citações

Outras Informações

ID Authenticus: P-00W-2KV

DOI: 10.1109/asew52652.2021.00014

Abstract (EN): Vulnerability detection and repair is a demanding and expensive part of the software development process. As such, there has been an effort to develop new and better ways to automatically detect and repair vulnerabilities. DifFuzz is a state-of-the-art tool for automatic detection of timing side-channel vulnerabilities, a type of vulnerability that is particularly difficult to detect and correct. Despite recent progress made with tools such as DifFuzz, work on tools capable of automatically repairing timing side-channel vulnerabilities is scarce. In this paper, we propose DifFuzzAR, a new tool for automatic repair of timing side-channel vulnerabilities in Java code. The tool works in conjunction with DifFuzz and it is able to repair 56% of the vulnerabilities identified in DifFuzz's dataset. The results show that the tool can indeed automatically correct timing side-channel vulnerabilities, being more effective with those that are controlflow based.

Idioma: Inglês

Tipo (Avaliação Docente): Científica

Nº de páginas: 8