DMCA
Automatic discovery and quantification of information leaks (2009)
Cached
Download Links
| Venue: | IN: IEEE SYMPOSIUM ON SECURITY AND PRIVACY |
| Citations: | 72 - 9 self |
BibTeX
@INPROCEEDINGS{Backes09automaticdiscovery,
author = {Michael Backes and Boris Köpf and Andrey Rybalchenko},
title = { Automatic discovery and quantification of information leaks},
booktitle = {IN: IEEE SYMPOSIUM ON SECURITY AND PRIVACY},
year = {2009},
pages = {141--153},
publisher = {}
}
Share
 |
 |
 |
 |
||
OpenURL
Abstract
Information-flow analysis is a powerful technique for reasoning about the sensitive information exposed by a program during its execution. We present the first automatic method for information-flow analysis that discovers what information is leaked and computes its comprehensive quantitative interpretation. The leaked information is characterized by an equivalence relation on secret artifacts, and is represented by a logical assertion over the corresponding program variables. Our measurement procedure computes the number of discovered equivalence classes and their sizes. This provides a basis for computing a set of quantitative properties, which includes all established information-theoretic measures in quantitative information-flow. Our method exploits an inherent connection between formal models of qualitative information-flow and program verification techniques. We provide an implementation of our method that builds upon existing tools for program verification and information-theoretic analysis. Our experimental evaluation indicates the practical applicability of the presented method.
Keyphrases
automatic discovery information leak information-flow analysis comprehensive quantitative interpretation leaked information information-theoretic measure experimental evaluation quantitative property inherent connection secret artifact measurement procedure logical assertion program verification information-theoretic analysis practical applicability formal model program verification technique sensitive information equivalence relation corresponding program variable first automatic method presented method discovered equivalence class quantitative information-flow powerful technique
