Measuring the strength of information flows in programs

ACM Transactions on Software Engineering and Methodology

Volumn 19, Issue 2, 2009, Pages

  Masri, Wes ^a   Podgurski, Andy ^b  

^a AMERICAN UNIVERSITY OF BEIRUT   (Lebanon)

^b Case Western Reserve University   (United States)

Author keywords

Correlation; Dynamic information flow analysis; Dynamic slicing; Entropy; Information flow length; Information flow strength; Information leakage; Program dependence

Indexed keywords

CORRELATION; DYNAMIC INFORMATION FLOW ANALYSIS; DYNAMIC SLICING; INFORMATION FLOW LENGTH; INFORMATION FLOW STRENGTH; INFORMATION LEAKAGE; PROGRAM DEPENDENCE;

DYNAMIC PROGRAMMING; INFORMATION THEORY; PULSATILE FLOW;

DYNAMIC ANALYSIS;

EID: 70350244718     PISSN: 1049331X     EISSN: 15577392     Source Type: Journal    
DOI: 10.1145/1571629.1571631     Document Type: Article

References (49)

1. AGRAWAL, H. AND HORGAN, J. 1990. Dynamic program slicing. SIGPLAN Not. 25, 6 (June), 246-256.
2. APIWATTANAPONG, T., ORSO A., ANDHARROLD, M. J. 2005. Efficient and precise dynamic impact analysis using ExecuteAfter sequences. In Proceedings of the International Conference on Software Engineering (St. Louis, MO, May).
3. BINKLEY, D. AND HARMAN, M. 2004. Analysis and visualization of predicate dependence on formal parameters and global variables. IEEE Trans. Softw. Eng. 30, 11, 715-735.
4. BISHOP, M. 2002. Computer Security: Art and Science. Addison-Wesley, Reading, MA.
5. BOX, G. E. P., HUNTER, J. S., AND HUNTER, W. G. 2005. Statistics for Experimenters: Design, Innovation, and Discovery, 2nd ed. Wiley, New York, NY.
6. CLARK, D., HUNT S., AND MALACARIA, P. 2001. Quantitative analysis of the leakage of confidential data. In Proceedings of Quantitative Aspects of Programming Languages (QAPL).
7. CLARK, D., HUNT S., AND MALACARIA, P. 2004. Quantified interference: Information theory and informationflow. In Proceedings of the IFIP WG 1.7, ACM SIGPLAN, and GI FoMSESS Workshop on Issues in the Theory of Security (Barcelona, Spain, Apr.).
8. CLAUSE, J., LI, W., AND ORSO, A. 2007. Dytan: A generic dynamic taint analysis framework. In Proceedings of the International Symposium on Software Testing and Analysis (ISSTA).
9. COVER, T. M. AND JOY, T. A. 1991. Elements of Information Theory. Wiley, New York, NY.
10. DALLMEIER, V., LINDIG, C., WASYLKOWSKI, A., ZELLER, A. 2006. Mining object behavior with ADABU. InProceedings of the 4th International Workshop on Dynamic Analysis(WODA, Shanghai, China, May).
11. DENNING, D. E. 1976. A lattice model of secure information flow. Commun. ACM. 19, 5, 236-242.
12. DENNING, D. E. 1982. Cryptography and Data Security. Addison-Wesley, Reading, MA.
13. DENNING, D. E. AND DENNING, P. J. 1977. Certification of programs for secure information flow. Commun. ACM. 20, 7, 504-513.
14. DO, H., ELBAUM, S., AND ROTHERMEL, G. 2005. Supporting controlled experimentation with testing techniques: An infrastructure and its potential impact. Emp. Softw. Eng. Internat. J. 10, 4, 405-435.
15. FENTON, J. S. 1974. Memoryless subsystems. Comput. J. 17, 2, 143-147.
16. FERRANTE, J., OTTENSTEIN, K. J., AND WARREN, J. D. 1987. The program dependence graph and its use in optimization. ACM Trans. Program. Lang. Syst. 9, 3 (July), 319-349.
17. KACHIGAN, S. 1986. Statistical Analysis: An Interdisciplinary Introduction to Univariate & Mul-tivariate Methods. Radius Press, New York, NY.
18. KOREL, B. AND YALAMANCHILI, S. 1994. Forward computation of dynamic program slices. In Proceedings of the ISSTA, 66-79.
19. KRUS, D. J. 2006. Visual statistics: Chapter 14. Regression on Multiple Categories. visualstatistics.net.
20. LAMPSON, B. W. 1973. A note on the confinement problem. Commun. ACM. 16, 10, 613-615.
21. LAW, J. AND ROTHERMEL, G. 2003. Whole program path-based dynamic impact analysis. In Proceedings of the International Conference on Software Engineering. 308-318.
22. LIEBERHERR, K. J. 2004. Controlling the complexity of software designs. In Proceedings of the International Conference on Software Engineering (Edinburgh, Scotland). 2-11.
23. LOWE, G. 2002. Quantifying informationflow. In Proceedings of the 15th IEEE Computer Security Foundations Workshop (CSFW), 18-31.
24. MASRI, W. 2004. Dynamic information flow analysis, slicing and profiling. Ph.D. dissertation. Case Western Reserve University, Cleveland, OH. wwwlib.umi.com/dissertations/fullcit/3146448.
25. MASRI, W. AND PODGURSKI, A. 2005. Using dynamic information flow analysis to detect attacks against applications. In Proceedings of the Software Engineering for Secure Systems (SESS, St. Louis, MO, May).
26. MASRI, W. AND PODGURSKI, A. 2006. An empirical study of the strength of information flows in programs. InProceedings of the 4th International Workshop on Dynamic Analysis(WODA, Shanghai, China, May).
27. MASRI, W., PODGURSKI, A.,ANDLEON,D. 2004. Detecting and debugging insecure information flows. In Proceedings of the 15th IEEE International Symposium on Software Reliability Engineering (ISSRE, St. Malo, France, Nov.).
28. MASRI, W., PODGURSKI, A., AND LEON, D. 2007. An empirical study of test case filtering techniques based on exercising information flows. In Proceedings of the IEEE Trans. Softw. Eng. 33, 7, 454-477.
29. MCCAMANT, S. AND ERNST, M. 2006. Quantitative information-flow tracking for C and related languages. MIT Computer Science and Artificial Intelligence Laboratory Tech. rep. MIT-CSAIL-TR-2006-2076 MIT, Cambridge, MA.
30. MCCAMANT, S. AND ERNST, M. 2007. A simulation-based proof technique for dynamic information flow. In Proceedings of the ACM SIGPLAN Workshop on Programming Languages and Analysis for Security (San Diego, CA, June).
31. NEWSOME, J. AND SONG, D. 2005. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In Proceedings of the Network and Distributed System Security Symposium.
32. NIST. 2001. Announcing the Advanced Encryption Standard (AES). Federal Information Processing Standards Publication 197, Nov. 26. National Institute of Science and Technology, Gaithersburg MD. http://csrc.nist.gov/publications/ fips/fips197/fips-197.pdf.
33. PEARL, J. 2000. Causality. Cambridge University Press, Cambridge, U.K.
34. PODGURSKI, A. 1989. Significance of program dependences for software testing, debugging and maintenance. Ph.D. dissertation, Computer Science Department, University of Massachusetts, Amherst, MA.
35. PODGURSKI, A. AND CLARKE, L. 1990. A formal model of program dependencies and its implications for software testing, debugging, and maintenance. IEEE Trans. Softw. Eng. 16, 9, 965-979.
36. SABELFELD, A. AND MYERS, A. C. 2003. Language-based information-flow security. IEEE J. Select. Areas Commun. 21, 1, 5-19.
37. SIEGEL, S. 1956. Nonparametric Statistics For The Behavioral Sciences. McGraw-Hill, New York, NY.
38. SINHA S., HARROLD, M. J., AND ROTHERMEL, G. 2000. Interprocedural control dependence. ACM Trans. Softw. Eng. Methodol. 10, 1, 209-254.
39. SPIRTES, P., GLYM OUR, C., AND SCHEINES, R. 2000. Causality, Prediction, and Search, 2nd ed. MIT Press, Cambridge, MA.
40. STEVEN, S., CHANDRA, P., FLECK, B., AND PODGURSKI, A. 2000. jRapture: A capture/replay tool for observation-based testing. 2000. In Proceedings of the International Symposium on Software Testing and Analysis. (Portland, OR), 158-167.
41. TIP, F. 1995. A survey of program slicing techniques. J. Program. Lang. 3, 3, 121-189.
42. VISSER, W., HAVELUND, K., BRAT, G. P., PARK, S., AND LERDA, F. 2003. Model checking programs. Automat. Softw. Eng. 10, 2, 203-232.
43. VOAS, J. AND MILLER, K. 1993. Semantic metrics for software testability. J. Syst. Softw. 20, 3, 207-216.
44. WOODWARD M. AND AL-KHANJAR, Z. 2000. Testability, fault size and the domain-to-range ratio: An eternal triangle. In Proceedings of the ISSTA. 168-172.
45. XIE, T., MARTIN, E., AND YUAN, H. 2006. Automatic extraction of abstract-object-state machines from unit-test executions. In Proceedings of the 28th International Conference on Software Engineering (ICSE). Research demonstrations.
46. ZHANG, X., GUPTA, N., AND GUPTA, R. 2006a. Locating faults through automated predicate switching. In Proceedings of the International Conference on Software Engineering.
47. ZHANG, X., GUPTA, N., AND GUPTA, R. 2006b. Pruning dynamic slices with confidence, In Proceedings of the PLDI.
48. ZHANG, X. AND GUPTA, R. 2004. Cost effective dynamic program slicing. In Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (Washington, DC, June). 94-106.
49. ZHANG, X., HE, H., GUPTA, N., AND GUPTA, R. 2005. Experimental evaluation of using dynamic slices for fault location. In Proceedings of the AADEBUG.