QFuzz：侧通道的定量模糊
QFuzz: Quantitative Fuzzing for Side Channels
摘要：
侧信道对软件系统的机密性构成了重大威胁。此类漏洞的检测和评估具有挑战性，因为它们来自软件的非功能属性，例如执行时间，并且需要对多个执行跟踪进行推理。最近，无干扰的概念已被采用在静态分析，符号执行，和灰盒模糊技术。然而，不干涉是一个严格的概念，即使信息泄漏的强度很弱，也可能拒绝安全性。安全性的定量概念允许放松不干涉，并容忍小的（不可避免的）泄漏。尽管近年来取得了进展，但现有的定量方法在实践中具有可扩展性限制。在这项工作中，我们提出了QFuzz，灰盒模糊技术定量评估的强度侧通道的最小熵为重点。最小熵是一种基于可区分的观察（分区）数量的度量，用于评估来自试图一次尝试就泄露秘密的攻击者的威胁。我们开发了一种新的灰盒模糊配备了两个分区算法，试图最大限度地提高可区分的意见和它们之间的成本差异。我们评估QFuzz的一个大的基准集从现有的工作和现实世界的图书馆（共70个科目）。QFuzz与三种最先进的检测技术相比毫不逊色。QFuzz提供了超出所有三种技术能力的关于泄漏的定量信息。至关重要的是，我们比较QFuzz的一个国家的最先进的量化工具，并发现QFuzz显着优于工具的可扩展性，同时保持类似的精度。总的来说，我们发现我们的方法可以很好地扩展到现实世界的应用程序，并提供有用的信息来评估由此产生的威胁。此外，QFuzz还识别了一个零D...
英文摘要：
Side channels pose a significant threat to the confidentiality of software systems. Such vulnerabilities are challenging to detect and evaluate because they arise from non-functional properties of software such as execution times and require reasoning on multiple execution traces. Recently, noninterference notions have been adapted in static analysis, symbolic execution, and greybox fuzzing techniques. However, noninterference is a strict notion and may reject security even if the strength of information leaks are weak. A quantitative notion of security allows for the relaxation of noninterference and tolerates small (unavoidable) leaks. Despite progress in recent years, the existing quantitative approaches have scalability limitations in practice. In this work, we present QFuzz, a greybox fuzzing technique to quantitatively evaluate the strength of side channels with a focus on min entropy. Min entropy is a measure based on the number of distinguishable observations (partitions) to assess the resulting threat from an attacker who tries to compromise secrets in one try. We develop a novel greybox fuzzing equipped with two partitioning algorithms that try to maximize the number of distinguishable observations and the cost differences between them. We evaluate QFuzz on a large set of benchmarks from existing work and real-world libraries (with a total of 70 subjects). QFuzz compares favorably to three state-of-the-art detection techniques. QFuzz provides quantitative information about leaks beyond the capabilities of all three techniques. Crucially, we compare QFuzz to a state-of-the-art quantification tool and find that QFuzz significantly outperforms the tool in scalability while maintaining similar precision. Overall, we find that our approach scales well for real-world applications and provides useful information to evaluate resulting threats. Additionally, QFuzz identifies a zero-d...
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
