T YPE -G UIDED W ORST -C ASE I NPUT G ENERATION Di Wang , Jan - PowerPoint PPT Presentation

λ T YPE -G UIDED W ORST -C ASE I NPUT G ENERATION Di Wang , Jan Hoffmann Carnegie Mellon University

R ESOURCE A NALYSIS Programs 2

R ESOURCE A NALYSIS Programs Performance 2

R ESOURCE A NALYSIS Time Memory Power … Programs Performance 2

R ESOURCE A NALYSIS Performance bottlenecks Worst-Case Algorithmic complexity Analysis Time vulnerabilities Memory Power … Timing side channels Programs Performance 2

E XAMPLE OF W ORST -C ASE A NALYSIS PHP 1 CVE - CVE-2011-4885. Available on: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4885. 2 PHP 5.3.8 - Hashtables Denial of Service. Available on https://www.exploit-db.com/exploits/18296/. 3 PHP: PHP 5 ChangeLog. Available on http://www.php.net/ChangeLog-5.php#5.3.9. 3

E XAMPLE OF W ORST -C ASE A NALYSIS Potential Denial-of-Service attack 1 PHP 1 CVE - CVE-2011-4885. Available on: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4885. 2 PHP 5.3.8 - Hashtables Denial of Service. Available on https://www.exploit-db.com/exploits/18296/. 3 PHP: PHP 5 ChangeLog. Available on http://www.php.net/ChangeLog-5.php#5.3.9. 3

E XAMPLE OF W ORST -C ASE A NALYSIS Potential Denial-of-Service attack 1 PHP Concrete exploits (by hash collisions) 2 1 CVE - CVE-2011-4885. Available on: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4885. 2 PHP 5.3.8 - Hashtables Denial of Service. Available on https://www.exploit-db.com/exploits/18296/. 3 PHP: PHP 5 ChangeLog. Available on http://www.php.net/ChangeLog-5.php#5.3.9. 3

E XAMPLE OF W ORST -C ASE A NALYSIS Potential Denial-of-Service attack 1 PHP Bug fixed! 3 Concrete exploits (by hash collisions) 2 1 CVE - CVE-2011-4885. Available on: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4885. 2 PHP 5.3.8 - Hashtables Denial of Service. Available on https://www.exploit-db.com/exploits/18296/. 3 PHP: PHP 5 ChangeLog. Available on http://www.php.net/ChangeLog-5.php#5.3.9. 3

E XAMPLE OF W ORST -C ASE A NALYSIS Potential Denial-of-Service attack 1 Worst-case inputs are instrumental to PHP understand and fix performance bugs! Bug fixed! 3 Concrete exploits (by hash collisions) 2 1 CVE - CVE-2011-4885. Available on: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4885. 2 PHP 5.3.8 - Hashtables Denial of Service. Available on https://www.exploit-db.com/exploits/18296/. 3 PHP: PHP 5 ChangeLog. Available on http://www.php.net/ChangeLog-5.php#5.3.9. 3

E XISTING A PPROACHES 4

E XISTING A PPROACHES Dynamic Fuzz testing Symbolic execution Dynamic worst-case analysis … Flexible & universal Potentially unsound: The resulting inputs might not expose the worst-case behavior. 4

E XISTING A PPROACHES Dynamic Static Fuzz testing Type systems Symbolic execution Abstract interpretation Dynamic worst-case analysis … … Sound upper bounds Flexible & universal Potentially not tight: No concrete Potentially unsound: The resulting witness — the bound might be inputs might not expose the too conservative. worst-case behavior. 4

C ONTRIBUTIONS A type-guided worst-case input generation algorithm Proof of soundness and relative completeness Heuristics to improve scalability 5

C ONTRIBUTIONS A type-guided worst-case input generation algorithm Proof of soundness and relative completeness Heuristics to improve scalability λ 5

C ONTRIBUTIONS A type-guided worst-case input generation algorithm Proof of soundness and relative completeness Heuristics to improve scalability λ Resource Aware ML (RaML) 5

C ONTRIBUTIONS A type-guided worst-case input generation algorithm Proof of soundness and relative completeness Heuristics to improve scalability λ Resource Aware ML (RaML) 5

C ONTRIBUTIONS A type-guided worst-case input generation algorithm Proof of soundness and relative completeness Heuristics to improve scalability λ Resource Aware ML (RaML) Symbolic Execution 5

C ONTRIBUTIONS A type-guided worst-case input generation algorithm Proof of soundness and relative completeness Heuristics to improve scalability λ Resource Aware ML (RaML) Guide Symbolic Execution 5

O VERVIEW Motivation Resource Aware ML (RaML) Type-Guided Worst-Case Input Generation Evaluation 6

A MORTIZED R ESOURCE A NALYSIS The potential method 7

A MORTIZED R ESOURCE A NALYSIS The potential method D 4 D 5 … … D 0 D 1 D 2 D 3 D n 7

A MORTIZED R ESOURCE A NALYSIS D i ’s are program states The potential method D 4 D 5 … … D 0 D 1 D 2 D 3 D n 7

A MORTIZED R ESOURCE A NALYSIS D i ’s are program states Arrows are transitions The potential method with actual costs D 4 D 5 … … D 0 D 1 D 2 D 3 D n 7

A MORTIZED R ESOURCE A NALYSIS D i ’s are program states Arrows are transitions The potential method with actual costs D 4 D 5 … … D 0 D 1 D 2 D 3 D n Φ ( D 0 ) Φ ( D 1 ) Φ ( D 2 ) Φ ( D 3 ) Φ ( D n ) 7

A MORTIZED R ESOURCE A NALYSIS D i ’s are program states Arrows are transitions The potential method with actual costs D 4 D 5 … … D 0 D 1 D 2 D 3 D n Φ ( D 0 ) Φ ( D 1 ) Φ ( D 2 ) Φ ( D 3 ) Φ ( D n ) The potential function maps program states to nonnegative numbers 7

A MORTIZED R ESOURCE A NALYSIS D i ’s are program states Arrows are transitions The potential method with actual costs D 4 D 5 … … D 0 D 1 D 2 D 3 D n Φ ( D 0 ) Φ ( D 1 ) Φ ( D 2 ) Φ ( D 3 ) Φ ( D n ) The potential function Φ ( D 2 ) ≥ Cost ( D 2 , D 3 ) + Φ ( D 3 ) maps program states to nonnegative numbers 7

A MORTIZED R ESOURCE A NALYSIS D i ’s are program states Arrows are transitions The potential method with actual costs D 4 D 5 … … D 0 D 1 D 2 D 3 D n Φ ( D 0 ) Φ ( D 1 ) Φ ( D 2 ) Φ ( D 3 ) Φ ( D n ) The potential function Φ ( D 2 ) ≥ Cost ( D 2 , D 3 ) + Φ ( D 3 ) The initial potential is an maps program states to upper bound! nonnegative numbers 7

T YPE -B ASED A NALYSIS The potential at a let rec lpairs l = program point is defined match l with | [] -> [] by a static annotation of | x1 :: xs -> match xs with data structures. | [] -> [] | x2 :: xs ’ -> A list of length n annotated if ( x1 : int ) < ( x2 : int ) then ( x1 , x2 ) :: lpairs xs ’ with a nonnegative number else lpairs xs ’ q has q·n units of potential. 8

T YPE -B ASED A NALYSIS The potential at a let rec lpairs l = program point is defined match l with | [] -> [] by a static annotation of | x1 :: xs -> match xs with data structures. | [] -> [] | x2 :: xs ’ -> A list of length n annotated if ( x1 : int ) < ( x2 : int ) then ( x1 , x2 ) :: lpairs xs ’ with a nonnegative number else lpairs xs ’ q has q·n units of potential. Each of [] , :: , (,) consumes 2 memory cells. 8

T YPE -B ASED A NALYSIS Cost = 2 ⋅ | ℓ | + 2 The potential at a let rec lpairs l = program point is defined match l with | [] -> [] by a static annotation of | x1 :: xs -> match xs with data structures. | [] -> [] | x2 :: xs ’ -> A list of length n annotated if ( x1 : int ) < ( x2 : int ) then ( x1 , x2 ) :: lpairs xs ’ with a nonnegative number else lpairs xs ’ q has q·n units of potential. Each of [] , :: , (,) consumes 2 memory cells. 8

T YPE -B ASED A NALYSIS L 2 ( 𝗃𝗈𝗎 ) 2/0 L 0 ( 𝗃𝗈𝗎 × 𝗃𝗈𝗎 ) The potential at a let rec lpairs l = program point is defined match l with | [] -> [] by a static annotation of | x1 :: xs -> match xs with data structures. | [] -> [] | x2 :: xs ’ -> A list of length n annotated if ( x1 : int ) < ( x2 : int ) then ( x1 , x2 ) :: lpairs xs ’ with a nonnegative number else lpairs xs ’ q has q·n units of potential. Each of [] , :: , (,) consumes 2 memory cells. 8

T YPE -B ASED A NALYSIS L 2 ( 𝗃𝗈𝗎 ) 2/0 L 0 ( 𝗃𝗈𝗎 × 𝗃𝗈𝗎 ) The potential at a let rec lpairs l = Φ 0 = 2 ⋅ | ℓ | + 2 program point is defined match l with | [] -> [] by a static annotation of | x1 :: xs -> match xs with data structures. | [] -> [] | x2 :: xs ’ -> A list of length n annotated if ( x1 : int ) < ( x2 : int ) then ( x1 , x2 ) :: lpairs xs ’ with a nonnegative number else lpairs xs ’ q has q·n units of potential. Each of [] , :: , (,) consumes 2 memory cells. 8

T YPE -B ASED A NALYSIS L 2 ( 𝗃𝗈𝗎 ) 2/0 L 0 ( 𝗃𝗈𝗎 × 𝗃𝗈𝗎 ) The potential at a let rec lpairs l = Φ 0 = 2 ⋅ | ℓ | + 2 program point is defined match l with | [] -> [] Cost = 2 by a static annotation of | x1 :: xs -> match xs with data structures. | [] -> [] | x2 :: xs ’ -> A list of length n annotated if ( x1 : int ) < ( x2 : int ) then ( x1 , x2 ) :: lpairs xs ’ with a nonnegative number else lpairs xs ’ q has q·n units of potential. Each of [] , :: , (,) consumes 2 memory cells. 8

T YPE -B ASED A NALYSIS L 2 ( 𝗃𝗈𝗎 ) 2/0 L 0 ( 𝗃𝗈𝗎 × 𝗃𝗈𝗎 ) The potential at a let rec lpairs l = program point is defined match l with | [] -> [] by a static annotation of | x1 :: xs -> Φ 1 = 2 ⋅ | xs | + 4 match xs with data structures. | [] -> [] | x2 :: xs ’ -> A list of length n annotated if ( x1 : int ) < ( x2 : int ) then ( x1 , x2 ) :: lpairs xs ’ with a nonnegative number else lpairs xs ’ q has q·n units of potential. Each of [] , :: , (,) consumes 2 memory cells. 8