Logo des Repositoriums

Auflistung nach Schlagwort "Dynamic Analysis"

1 - 2 von 2
  • Konferenzbeitrag
    DifFuzz: Differential Fuzzing for Side-Channel Analysis
    (Software Engineering 2020, 2020) Nilizadeh, Shirin; Noller, Yannic; Noller, Yannic
    This summary is based on our research results on ``DifFuzz: Differential Fuzzing for Side-Channel Analysis'' which was published in the proceedings of the 41st International Conference on Software Engineering. Side-channel analysis aims to investigate the risk that a potential attacker can infer any secret information through observations of the system, such as the execution time or the memory consumption. Side-channel vulnerabilities therefore represent security risks that can cause serious damage and need to be identified and repaired. DifFuzz applies differential fuzzing to identify inputs that trigger such vulnerabilities. Our fuzzing approach analyzes multiple program executions, which vary in their secret information, and uses resource-guided heuristics to identify inputs that maximize the observable cost difference between these executions. Our evaluation shows that such a dynamic analysis approach can find the same side-channel vulnerabilities as state-of-the-art static analysis techniques, and even more vulnerabilities since it does not rely on models for its analysis. Additionally, the advantage of DifFuzz compared to other techniques is not only that it can generate inputs that show a vulnerability, but that the resulting cost difference can also be used to estimate the severity of an identified vulnerability. This enables the comparing of repaired versions of an application.
  • Zeitschriftenartikel
    Software Performance Anti-Patterns Observed and Resolved in Kieker
    (Softwaretechnik-Trends Band 35, Heft 3, 2015) Wulf, Christian; Hasselbring, Wilhelm
    Software performance anti-patterns describe bad-practice solutions for particular problems. They help in sensitizing software engineering to such situations. In this paper, we focus on anti-patterns of monitoring and dynamic analysis frameworks, such as Kieker. These frameworks typically have high requirements on a low monitoring overhead and a high-throughput analysis performance. We describe three observed anti-patterns which influenced previous versions of Kieker with a high impact on the performance. Moreover, we present our solution for each of the anti-patterns.