Feedback-Driven Side-Channel Analysis for Networked Applications
Information leakage in software systems is a problem of growing importance. Networked applications can leak sensitive information even when they use encryption. For example, some characteristics of network packets, such as their size, timing and direction, are visible even for encrypted traffic. Patterns in these characteristics can be leveraged as side channels to extract information about secret values accessed by the application. In this paper, we present a new tool called AutoFeed for detecting and quantifying information leakage due to side channels in networked software applications. AutoFeed profiles the target system and automatically explores the input space, explores the space of output features that may leak information, quantifies the information leakage, and identifies the top-leaking features. Given a set of input mutators and a small number of initial inputs provided by the user, AutoFeed iteratively mutates inputs and periodically updates its leakage estimations to identify the features that leak the greatest amount of information about the secret of interest. AutoFeed uses a feedback loop for incremental profiling, and a stopping criterion that terminates the analysis when the leakage estimation for the top-leaking features converges. AutoFeed also automatically assigns weights to mutators in order to focus the search of the input space on exploring dimensions that are relevant to the leakage quantification. Our experimental evaluation on the benchmarks shows that AutoFeed is effective in detecting and quantifying information leaks in networked applications.
Tue 21 JulDisplayed time zone: Tijuana, Baja California change
13:30 - 14:30 | SECURITYTechnical Papers at Zoom Chair(s): Lucas Bang Harvey Mudd College Public Live Stream/Recording. Registered participants should join via the Zoom link distributed in Slack. | ||
13:30 20mTalk | Feedback-Driven Side-Channel Analysis for Networked Applications Technical Papers Ismet Burak Kadron University of California at Santa Barbara, Nico Rosner Amazon Web Services, Tevfik Bultan University of California, Santa Barbara DOI | ||
13:50 20mTalk | Scalable Analysis of Interaction Threats in IoT Systems Technical Papers Mohannad Alhanahnah , Clay Stevens University of Nebraska-Lincoln, Hamid Bagheri University of Nebraska-Lincoln, USA DOI Pre-print Media Attached | ||
14:10 20mTalk | DeepSQLi: Deep Semantic Learning for Testing SQL Injection Technical Papers DOI Pre-print |