-
FOX: Coverage-guided Fuzzing as Online Stochastic Control
Authors:
Dongdong She,
Adam Storek,
Yuchong Xie,
Seoyoung Kweon,
Prashast Srivastava,
Suman Jana
Abstract:
Fuzzing is an effective technique for discovering software vulnerabilities by generating random test inputs and executing them against the target program. However, fuzzing large and complex programs remains challenging due to difficulties in uncovering deeply hidden vulnerabilities. This paper addresses the limitations of existing coverage-guided fuzzers, focusing on the scheduler and mutator comp…
▽ More
Fuzzing is an effective technique for discovering software vulnerabilities by generating random test inputs and executing them against the target program. However, fuzzing large and complex programs remains challenging due to difficulties in uncovering deeply hidden vulnerabilities. This paper addresses the limitations of existing coverage-guided fuzzers, focusing on the scheduler and mutator components. Existing schedulers suffer from information sparsity and the inability to handle fine-grained feedback metrics. The mutators are agnostic of target program branches, leading to wasted computation and slower coverage exploration. To overcome these issues, we propose an end-to-end online stochastic control formulation for coverage-guided fuzzing. Our approach incorporates a novel scheduler and custom mutator that can adapt to branch logic, maximizing aggregate edge coverage achieved over multiple stages. The scheduler utilizes fine-grained branch distance measures to identify frontier branches, where new coverage is likely to be achieved. The mutator leverages branch distance information to perform efficient and targeted seed mutations, leading to robust progress with minimal overhead. We present FOX, a proof-of-concept implementation of our control-theoretic approach, and compare it to industry-standard coverage-guided fuzzers. 6 CPU-years of extensive evaluations on the FuzzBench dataset and complex real-world programs (a total of 38 test programs) demonstrate that FOX outperforms existing state-of-the-art fuzzers, achieving average coverage improvements up to 26.45% in real-world standalone programs and 6.59% in FuzzBench programs over the state-of-the-art AFL++. In addition, it uncovers 20 unique bugs in popular real-world applications including eight that are previously unknown, showcasing real-world security impact.
△ Less
Submitted 6 June, 2024;
originally announced June 2024.
-
Spin-momentum locking and ultrafast spin-charge conversion in ultrathin epitaxial Bi$_{1-x}$Sb$_x$ topological insulator
Authors:
E. Rongione,
L. Baringthon,
D. She,
G. Patriarche,
R. Lebrun,
A. Lemaitre,
M. Morassi,
N. Reyren,
M. Micica,
J. Mangeney,
J. Tignon,
F. Bertran,
S. Dhillon,
P. Le Fevre,
H. Jaffres,
J. -M. George
Abstract:
The helicity of 3D topological insulator surface states has drawn significant attention in spintronics owing to spin-momentum locking where the carriers' spin is oriented perpendicular to their momentum. This property can provide an efficient method to convert charge currents into spin currents, and vice-versa, through the Rashba-Edelstein effect. However, experimental signatures of these surface…
▽ More
The helicity of 3D topological insulator surface states has drawn significant attention in spintronics owing to spin-momentum locking where the carriers' spin is oriented perpendicular to their momentum. This property can provide an efficient method to convert charge currents into spin currents, and vice-versa, through the Rashba-Edelstein effect. However, experimental signatures of these surface states to the spin-charge conversion are extremely difficult to disentangle from bulk state contributions. Here, we combine spin- and angle-resolved photo-emission spectroscopy, and time-resolved THz emission spectroscopy to categorically demonstrate that spin-charge conversion arises mainly from the surface state in Bi$_{1-x}$Sb$_x$ ultrathin films, down to few nanometers where confinement effects emerge. We correlate this large conversion efficiency, typically at the level of the bulk spin Hall effect from heavy metals, to the complex Fermi surface obtained from theoretical calculations of the inverse Rashba-Edelstein response. %We demonstrate this for film thickness down to a few nanometers, Both surface state robustness and sizeable conversion efficiency in epitaxial Bi$_{1-x}$Sb$_x$ thin films bring new perspectives for ultra-low power magnetic random-access memories and broadband THz generation.
△ Less
Submitted 25 March, 2023;
originally announced March 2023.
-
Stability of Rankin-Selberg local $γ$-factors for split classical groups: the symplectic case
Authors:
Taiwang Deng,
Dongming She
Abstract:
Given a split classical group of symplectic type and a split general linear group over a local field $F$, we use Langlands-Shahidi method to construct their Rankin-Selberg local $γ$-factors and prove the corresponding analytic stability for generic representations. The idea generalizes the work of J. Cogdell, F. Shahidi, T.-L. Tsai in 2017 and D. She in 2023 in the study of asymptotic behaviors of…
▽ More
Given a split classical group of symplectic type and a split general linear group over a local field $F$, we use Langlands-Shahidi method to construct their Rankin-Selberg local $γ$-factors and prove the corresponding analytic stability for generic representations. The idea generalizes the work of J. Cogdell, F. Shahidi, T.-L. Tsai in 2017 and D. She in 2023 in the study of asymptotic behaviors of partial Bessel functions. Different from the known cases, suppose $P=MN$ is the maximal parabolic subgroup with Levi component $M\simeq \mathrm{GL}_r\times\mathrm{Sp}_{2m}$ that defines the local factors, the action of the maximal unipotent subgroup of $M$ on $N$ have non-trivial stabilizers, and the space of integration for the corresponding local coefficient is no longer isomorphic to a torus. We will separate its toric part out in our cases and show that it plays the same role as the torus over which the integral representing the local coefficient is taken in the known cases. This is a new phenomenon with sufficient generality and we believe that it may provide us with a possible direction towards a uniform proof of stability of Langlands-Shahidi $γ$-factors in our future work.
△ Less
Submitted 17 March, 2023;
originally announced March 2023.
-
Dynamical magnetic fields in heavy-ion collisions
Authors:
Anping Huang,
Duan She,
Shuzhe Shi,
Mei Huang,
Jinfeng Liao
Abstract:
The magnetic fields in heavy-ion collisions are important ingredients for many interesting phenomena, such as the Chiral Magnetic Effect, Chiral Magnetic Wave, the directed flow $v_1$ of $D^0$ mesons and the splitting of the spin polarization of the $Λ$/$\barΛ$. Quantitative studies of these phenomena however suffer from limited understanding on the dynamical evolution of these fields in the mediu…
▽ More
The magnetic fields in heavy-ion collisions are important ingredients for many interesting phenomena, such as the Chiral Magnetic Effect, Chiral Magnetic Wave, the directed flow $v_1$ of $D^0$ mesons and the splitting of the spin polarization of the $Λ$/$\barΛ$. Quantitative studies of these phenomena however suffer from limited understanding on the dynamical evolution of these fields in the medium created by the collisions, which remains a critical and challenging problem. The initial magnetic fields from the colliding nuclei decay very fast in the vacuum but their lifetime could be extended through medium response due to electrically conducting quarks and antiquarks. Here we perform a detailed analysis of such medium effect on the dynamical magnetic fields by numerically solving the Maxwell's equations concurrently with the expanding medium described by viscous hydrodynamics, under the assumption of negligible back reaction of the fields on the fluid evolution. Our results suggest a considerable enhancement of late time magnetic fields, the magnitude of which depends sensitively on the fireball expansion as well as the medium electric conductivity both before and during hydrodynamic stage.
△ Less
Submitted 6 April, 2023; v1 submitted 16 December, 2022;
originally announced December 2022.
-
Anomalous magnetohydrodynamics with temperature-dependent electric conductivity and application to the global polarization
Authors:
Hao-Hao Peng,
Sihao Wu,
Ren-jie Wang,
Duan She,
Shi Pu
Abstract:
We have derived the solutions of the relativistic anomalous magnetohydrodynamics with longitudinal Bjorken boost invariance and transverse electromagnetic fields in the presence of temperature or energy density dependent electric conductivity. We consider the equations of states in a high temperature limit or in a high chiral chemical potential limit. We obtain both perturbative analytic solutions…
▽ More
We have derived the solutions of the relativistic anomalous magnetohydrodynamics with longitudinal Bjorken boost invariance and transverse electromagnetic fields in the presence of temperature or energy density dependent electric conductivity. We consider the equations of states in a high temperature limit or in a high chiral chemical potential limit. We obtain both perturbative analytic solutions up to the order of \hbar and numerical solutions in our configurations of initial electromagnetic fields and Bjorken flow velocity. Our results show that the temperature or energy density dependent electric conductivity plays an important role to the decaying of the energy density and electromagnetic fields. We also implement our results to the splitting of global polarization for Λand \barΛ hyperons induced by the magnetic fields. Our results for the splitting of global polarization disagree with the experimental data in low energy collisions, which implies that the contribution from gradient of chemical potential may dominate in the low energy collisions.
△ Less
Submitted 21 November, 2022;
originally announced November 2022.
-
NeuDep: Neural Binary Memory Dependence Analysis
Authors:
Kexin Pei,
Dongdong She,
Michael Wang,
Scott Geng,
Zhou Xuan,
Yaniv David,
Junfeng Yang,
Suman Jana,
Baishakhi Ray
Abstract:
Determining whether multiple instructions can access the same memory location is a critical task in binary analysis. It is challenging as statically computing precise alias information is undecidable in theory. The problem aggravates at the binary level due to the presence of compiler optimizations and the absence of symbols and types. Existing approaches either produce significant spurious depend…
▽ More
Determining whether multiple instructions can access the same memory location is a critical task in binary analysis. It is challenging as statically computing precise alias information is undecidable in theory. The problem aggravates at the binary level due to the presence of compiler optimizations and the absence of symbols and types. Existing approaches either produce significant spurious dependencies due to conservative analysis or scale poorly to complex binaries.
We present a new machine-learning-based approach to predict memory dependencies by exploiting the model's learned knowledge about how binary programs execute. Our approach features (i) a self-supervised procedure that pretrains a neural net to reason over binary code and its dynamic value flows through memory addresses, followed by (ii) supervised finetuning to infer the memory dependencies statically. To facilitate efficient learning, we develop dedicated neural architectures to encode the heterogeneous inputs (i.e., code, data values, and memory addresses from traces) with specific modules and fuse them with a composition learning strategy.
We implement our approach in NeuDep and evaluate it on 41 popular software projects compiled by 2 compilers, 4 optimizations, and 4 obfuscation passes. We demonstrate that NeuDep is more precise (1.5x) and faster (3.5x) than the current state-of-the-art. Extensive probing studies on security-critical reverse engineering tasks suggest that NeuDep understands memory access patterns, learns function signatures, and is able to match indirect calls. All these tasks either assist or benefit from inferring memory dependencies. Notably, NeuDep also outperforms the current state-of-the-art on these tasks.
△ Less
Submitted 4 October, 2022;
originally announced October 2022.
-
$MC^2$: Rigorous and Efficient Directed Greybox Fuzzing
Authors:
Abhishek Shah,
Dongdong She,
Samanway Sadhu,
Krish Singal,
Peter Coffman,
Suman Jana
Abstract:
Directed greybox fuzzing is a popular technique for targeted software testing that seeks to find inputs that reach a set of target sites in a program. Most existing directed greybox fuzzers do not provide any theoretical analysis of their performance or optimality.
In this paper, we introduce a complexity-theoretic framework to pose directed greybox fuzzing as a oracle-guided search problem wher…
▽ More
Directed greybox fuzzing is a popular technique for targeted software testing that seeks to find inputs that reach a set of target sites in a program. Most existing directed greybox fuzzers do not provide any theoretical analysis of their performance or optimality.
In this paper, we introduce a complexity-theoretic framework to pose directed greybox fuzzing as a oracle-guided search problem where some feedback about the input space (e.g., how close an input is to the target sites) is received by querying an oracle. Our framework assumes that each oracle query can return arbitrary content with a large but constant amount of information. Therefore, we use the number of oracle queries required by a fuzzing algorithm to find a target-reaching input as the performance metric. Using our framework, we design a randomized directed greybox fuzzing algorithm that makes a logarithmic (wrt. the number of all possible inputs) number of queries in expectation to find a target-reaching input. We further prove that the number of oracle queries required by our algorithm is optimal, i.e., no fuzzing algorithm can improve (i.e., minimize) the query count by more than a constant factor.
We implement our approach in MC$^2$ and outperform state-of-the-art directed greybox fuzzers on challenging benchmarks (Magma and Fuzzer Test Suite) by up to two orders of magnitude (i.e., $134\times$) on average. MC$^2$ also found 15 previously undiscovered bugs that other state-of-the-art directed greybox fuzzers failed to find.
△ Less
Submitted 30 August, 2022;
originally announced August 2022.
-
Effective Seed Scheduling for Fuzzing with Graph Centrality Analysis
Authors:
Dongdong She,
Abhishek Shah,
Suman Jana
Abstract:
Seed scheduling, the order in which seeds are selected, can greatly affect the performance of a fuzzer. Existing approaches schedule seeds based on their historical mutation data, but ignore the structure of the underlying Control Flow Graph (CFG). Examining the CFG can help seed scheduling by revealing the potential edge coverage gain from mutating a seed. An ideal strategy will schedule seeds ba…
▽ More
Seed scheduling, the order in which seeds are selected, can greatly affect the performance of a fuzzer. Existing approaches schedule seeds based on their historical mutation data, but ignore the structure of the underlying Control Flow Graph (CFG). Examining the CFG can help seed scheduling by revealing the potential edge coverage gain from mutating a seed. An ideal strategy will schedule seeds based on a count of all reachable and feasible edges from a seed through mutations, but computing feasibility along all edges is prohibitively expensive. Therefore, a seed scheduling strategy must approximate this count. We observe that an approximate count should have 3 properties -- (i) it should increase if there are more edges reachable from a seed; (ii) it should decrease if mutation history information suggests an edge is hard to reach or is located far away from currently visited edges; and (iii) it should be efficient to compute over large CFGs. We observe that centrality measures from graph analysis naturally provide these three properties and therefore can efficiently approximate the likelihood of reaching unvisited edges by mutating a seed. We therefore build a graph called the edge horizon graph that connects seeds to their closest unvisited nodes and compute the seed node's centrality to measure the potential edge coverage gain from mutating a seed. We implement our approach in K-scheduler and compare with many popular seed scheduling strategies. We find that K-scheduler increases feature coverage by 25.89% compared to Entropic and edge coverage by 4.21% compared to the next-best AFL-based seed scheduler, in arithmetic mean on 12 Google FuzzBench programs. It also finds 3 more previously-unknown bugs than the next-best AFL-based seed scheduler.
△ Less
Submitted 24 March, 2022; v1 submitted 22 March, 2022;
originally announced March 2022.
-
Relativistic Viscous Hydrodynamics with Angular Momentum
Authors:
Duan She,
Anping Huang,
Defu Hou,
Jinfeng Liao
Abstract:
Hydrodynamics is a general theoretical framework for describing the long-time large-distance behaviors of various macroscopic physical systems, with its equations based on conservation laws such as energy-momentum conservation and charge conservation. Recently there has been significant interest in understanding the implications of angular momentum conservation for a corresponding hydrodynamic the…
▽ More
Hydrodynamics is a general theoretical framework for describing the long-time large-distance behaviors of various macroscopic physical systems, with its equations based on conservation laws such as energy-momentum conservation and charge conservation. Recently there has been significant interest in understanding the implications of angular momentum conservation for a corresponding hydrodynamic theory. In this work, we examine the key conceptual issues for such a theory in the relativistic regime where the orbital and spin components get entangled. We derive the equations for relativistic viscous hydrodynamics with angular momentum through Navier-Stokes type of gradient expansion analysis and find five new transport coefficients for angular momentum diffusion modes.
△ Less
Submitted 3 December, 2022; v1 submitted 9 May, 2021;
originally announced May 2021.
-
MTFuzz: Fuzzing with a Multi-Task Neural Network
Authors:
Dongdong She,
Rahul Krishna,
Lu Yan,
Suman Jana,
Baishakhi Ray
Abstract:
Fuzzing is a widely used technique for detecting software bugs and vulnerabilities. Most popular fuzzers generate new inputs using an evolutionary search to maximize code coverage. Essentially, these fuzzers start with a set of seed inputs, mutate them to generate new inputs, and identify the promising inputs using an evolutionary fitness function for further mutation. Despite their success, evolu…
▽ More
Fuzzing is a widely used technique for detecting software bugs and vulnerabilities. Most popular fuzzers generate new inputs using an evolutionary search to maximize code coverage. Essentially, these fuzzers start with a set of seed inputs, mutate them to generate new inputs, and identify the promising inputs using an evolutionary fitness function for further mutation. Despite their success, evolutionary fuzzers tend to get stuck in long sequences of unproductive mutations. In recent years, machine learning (ML) based mutation strategies have reported promising results. However, the existing ML-based fuzzers are limited by the lack of quality and diversity of the training data. As the input space of the target programs is high dimensional and sparse, it is prohibitively expensive to collect many diverse samples demonstrating successful and unsuccessful mutations to train the model. In this paper, we address these issues by using a Multi-Task Neural Network that can learn a compact embedding of the input space based on diverse training samples for multiple related tasks (i.e., predicting for different types of coverage). The compact embedding can guide the mutation process by focusing most of the mutations on the parts of the embedding where the gradient is high. \tool uncovers $11$ previously unseen bugs and achieves an average of $2\times$ more edge coverage compared with 5 state-of-the-art fuzzer on 10 real-world programs.
△ Less
Submitted 11 September, 2020; v1 submitted 25 May, 2020;
originally announced May 2020.
-
Accelerating longitudinal expansion of resistive relativistic-magneto-hydrodynamics in heavy ion collisions
Authors:
M. Haddadi Moghaddam,
W. M. Alberico,
Duan She,
A. F. Kord,
B. Azadegan
Abstract:
We study the evolution of the longitudinal expansion of an ideal fluid with finite electrical conductivity, which is subject to the EM fields. In the framework of resistive relativistic-magneto-hydrodynamic, we find an exact analytical solution for the EM fields and for the acceleration of the fluid.
We study the evolution of the longitudinal expansion of an ideal fluid with finite electrical conductivity, which is subject to the EM fields. In the framework of resistive relativistic-magneto-hydrodynamic, we find an exact analytical solution for the EM fields and for the acceleration of the fluid.
△ Less
Submitted 22 February, 2020;
originally announced February 2020.
-
Perturbation solutions of relativistic viscous hydrodynamics for longitudinally expanding fireballs
Authors:
Ze-Fang Jiang,
Duan She,
C. B. Yang,
Defu Hou
Abstract:
The solutions of relativistic viscous hydrodynamics for longitudinal expanding fireballs is investigated with the Navier-Stokes theory and Israel-Stewart theory. The energy and Euler conservation equations for the viscous fluid are derived in Rindler coordinates with the longitudinal expansion effect is small. Under the perturbation assumption, an analytical perturbation solution for the Navier-St…
▽ More
The solutions of relativistic viscous hydrodynamics for longitudinal expanding fireballs is investigated with the Navier-Stokes theory and Israel-Stewart theory. The energy and Euler conservation equations for the viscous fluid are derived in Rindler coordinates with the longitudinal expansion effect is small. Under the perturbation assumption, an analytical perturbation solution for the Navier-Stokes approximation and numerical solutions for the Israel-Stewart approximation are presented. The temperature evolution with both shear viscous effect and longitudinal acceleration effect in the longitudinal expanding framework are presented and specifically temperature profile shows symmetry Gaussian shape in the Rindler coordinates. In addition, in the presence of the longitudinal acceleration expanding effect, the results of the Israel-Stewart approximation are compared to the results from Bjorken and Navier-Stokes approximation, and it gives a good description than the Navier-Stokes theories results at the early stages of evolution.
△ Less
Submitted 30 April, 2020; v1 submitted 26 January, 2020;
originally announced January 2020.
-
Chiral magnetic effect for chiral fermion system
Authors:
Ren-Da Dong,
Ren-Hong Fang,
De-Fu Hou,
Duan She
Abstract:
We concisely derive chiral magnetic effect through Wigner function approach for chiral fermion system. Then we derive chiral magnetic effect through solving the Landau levels of chiral fermions in detail. The procedures of second quantization and ensemble average lead to the equation of chiral magnetic effect for righthand and lefthand fermion systems. Chiral magnetic effect only comes from the co…
▽ More
We concisely derive chiral magnetic effect through Wigner function approach for chiral fermion system. Then we derive chiral magnetic effect through solving the Landau levels of chiral fermions in detail. The procedures of second quantization and ensemble average lead to the equation of chiral magnetic effect for righthand and lefthand fermion systems. Chiral magnetic effect only comes from the contribution of the lowest Landau level. We carefully analyze the lowest Landau level, and find that all righthand (chirality is +1) fermions move along positive z-direction and all lefthand (chirality is -1) fermions move along negative z-direction. From this picture chiral magnetic effect can be explained clearly in a microscopic way.
△ Less
Submitted 16 January, 2020;
originally announced January 2020.
-
Stability of symmetric cube gamma factors for GL(2)
Authors:
Daniel Shankman,
Dongming She
Abstract:
We give a new proof of the stability of the symmetric cube gamma factor as defined by the Langlands-Shahidi method.
We give a new proof of the stability of the symmetric cube gamma factor as defined by the Langlands-Shahidi method.
△ Less
Submitted 8 November, 2019;
originally announced November 2019.
-
Local Langlands correspondence for the twisted exterior and symmetric square $ε$-factors of $\textrm{GL}_n$
Authors:
Dongming She
Abstract:
Let $F$ be a non-Archimedean local field. Let $\mathcal{A}_n(F)$ be the set of equivalence classes of irreducible admissible representations of $\textrm{GL}_n(F)$, and $\mathcal{G}_n(F)$ be the set of equivalence classes of n-dimensional Frobenius semisimple Weil-Deligne representations of $W'_F$. The local Langlands correspondence(LLC) establishes the reciprocity maps…
▽ More
Let $F$ be a non-Archimedean local field. Let $\mathcal{A}_n(F)$ be the set of equivalence classes of irreducible admissible representations of $\textrm{GL}_n(F)$, and $\mathcal{G}_n(F)$ be the set of equivalence classes of n-dimensional Frobenius semisimple Weil-Deligne representations of $W'_F$. The local Langlands correspondence(LLC) establishes the reciprocity maps $\textrm{Rec}_{n,F}: \mathcal{A}_n(F)\longrightarrow \mathcal{G}_n(F)$ , satisfying some nice properties. An important invariant under this correspondence is the L- and $ε$-factors. This is also expected to be true under parallel compositions with a complex analytic representations of $\textrm{GL}_n(\mathbb{C})$. J.W. Cogdell, F. Shahidi, and T.-L. Tsai proved the equality of the symmetric and exterior square L- and $ε$-factors [7] in 2017. But the twisted symmetric and exterior square L- and $ε$-factor are new and very different from the untwisted case. In this paper we will define the twisted symmetric square L- and $γ$-factors using $\textrm{GSpin}_{2n+1}$, and establish the equality of the corresponding L- and $ε$-factors. We will first reduce the problem to the analytic stability of their $γ$-factors for supercuspidal representations, then prove the supercuspidal stability by establishing general asymptotic expansions of partial Bessel function following the ideas in [7].
△ Less
Submitted 3 May, 2020; v1 submitted 6 October, 2019;
originally announced October 2019.
-
Fine Grained Dataflow Tracking with Proximal Gradients
Authors:
Gabriel Ryan,
Abhishek Shah,
Dongdong She,
Koustubha Bhat,
Suman Jana
Abstract:
Dataflow tracking with Dynamic Taint Analysis (DTA) is an important method in systems security with many applications, including exploit analysis, guided fuzzing, and side-channel information leak detection. However, DTA is fundamentally limited by the Boolean nature of taint labels, which provide no information about the significance of detected dataflows and lead to false positives/negatives on…
▽ More
Dataflow tracking with Dynamic Taint Analysis (DTA) is an important method in systems security with many applications, including exploit analysis, guided fuzzing, and side-channel information leak detection. However, DTA is fundamentally limited by the Boolean nature of taint labels, which provide no information about the significance of detected dataflows and lead to false positives/negatives on complex real world programs.
We introduce proximal gradient analysis (PGA), a novel, theoretically grounded approach that can track more accurate and fine-grained dataflow information. PGA uses proximal gradients, a generalization of gradients for non-differentiable functions, to precisely compose gradients over non-differentiable operations in programs. Composing gradients over programs eliminates many of the dataflow propagation errors that occur in DTA and provides richer information about how each measured dataflow effects a program.
We compare our prototype PGA implementation to three state of the art DTA implementations on 7 real-world programs. Our results show that PGA can improve the F1 accuracy of data flow tracking by up to 33% over taint tracking (20% on average) without introducing any significant overhead (<5% on average). We further demonstrate the effectiveness of PGA by discovering 22 bugs (20 confirmed by developers) and 2 side-channel leaks, and identifying exploitable dataflows in 19 existing CVEs in the tested programs.
△ Less
Submitted 24 February, 2021; v1 submitted 8 September, 2019;
originally announced September 2019.
-
Neutaint: Efficient Dynamic Taint Analysis with Neural Networks
Authors:
Dongdong She,
Yizheng Chen,
Abhishek Shah,
Baishakhi Ray,
Suman Jana
Abstract:
Dynamic taint analysis (DTA) is widely used by various applications to track information flow during runtime execution. Existing DTA techniques use rule-based taint-propagation, which is neither accurate (i.e., high false positive) nor efficient (i.e., large runtime overhead). It is hard to specify taint rules for each operation while covering all corner cases correctly. Moreover, the overtaint an…
▽ More
Dynamic taint analysis (DTA) is widely used by various applications to track information flow during runtime execution. Existing DTA techniques use rule-based taint-propagation, which is neither accurate (i.e., high false positive) nor efficient (i.e., large runtime overhead). It is hard to specify taint rules for each operation while covering all corner cases correctly. Moreover, the overtaint and undertaint errors can accumulate during the propagation of taint information across multiple operations. Finally, rule-based propagation requires each operation to be inspected before applying the appropriate rules resulting in prohibitive performance overhead on large real-world applications.
In this work, we propose NEUTAINT, a novel end-to-end approach to track information flow using neural program embeddings. The neural program embeddings model the target's programs computations taking place between taint sources and sinks, which automatically learns the information flow by observing a diverse set of execution traces. To perform lightweight and precise information flow analysis, we utilize saliency maps to reason about most influential sources for different sinks. NEUTAINT constructs two saliency maps, a popular machine learning approach to influence analysis, to summarize both coarse-grained and fine-grained information flow in the neural program embeddings.
We compare NEUTAINT with 3 state-of-the-art dynamic taint analysis tools. The evaluation results show that NEUTAINT can achieve 68% accuracy, on average, which is 10% improvement while reducing 40 times runtime overhead over the second-best taint tool Libdft on 6 real world programs. NEUTAINT also achieves 61% more edge coverage when used for taint-guided fuzzing indicating the effectiveness of the identified influential bytes.
△ Less
Submitted 3 September, 2019; v1 submitted 8 July, 2019;
originally announced July 2019.
-
1+1 dimensional relativistic magnetohydrodynamics with longitudinal acceleration
Authors:
Duan She,
Ze Fang Jiang,
De-fu Hou,
C. B. Yang
Abstract:
Non-central heavy-ion collisions generate the strongest magnetic field of the order of $10^{18}-10^{19}$ Gauss due to the electric current produced by the positively charged spectators that travel at nearly the speed of light. Such transient electromagnetic fields may induce various novel effects in the hydrodynamic description of the quark gluon plasma for non-central heavy-ion collisions. We inv…
▽ More
Non-central heavy-ion collisions generate the strongest magnetic field of the order of $10^{18}-10^{19}$ Gauss due to the electric current produced by the positively charged spectators that travel at nearly the speed of light. Such transient electromagnetic fields may induce various novel effects in the hydrodynamic description of the quark gluon plasma for non-central heavy-ion collisions. We investigate the longitudinal acceleration effects on the 1+1 dimensional relativistic magnetohydrodynamics with transverse magnetic fields. We analyze the proper time evolution of the system energy density. We find that the longitudinal acceleration parameter $λ^*$, magnetic field decay parameter $a$, equation of state $κ$, and initial magnetization $σ_0$ have nontrivial effects on the evolutions of the system energy density and temperature.
△ Less
Submitted 2 July, 2019;
originally announced July 2019.
-
On Training Robust PDF Malware Classifiers
Authors:
Yizheng Chen,
Shiqi Wang,
Dongdong She,
Suman Jana
Abstract:
Although state-of-the-art PDF malware classifiers can be trained with almost perfect test accuracy (99%) and extremely low false positive rate (under 0.1%), it has been shown that even a simple adversary can evade them. A practically useful malware classifier must be robust against evasion attacks. However, achieving such robustness is an extremely challenging task.
In this paper, we take the fi…
▽ More
Although state-of-the-art PDF malware classifiers can be trained with almost perfect test accuracy (99%) and extremely low false positive rate (under 0.1%), it has been shown that even a simple adversary can evade them. A practically useful malware classifier must be robust against evasion attacks. However, achieving such robustness is an extremely challenging task.
In this paper, we take the first steps towards training robust PDF malware classifiers with verifiable robustness properties. For instance, a robustness property can enforce that no matter how many pages from benign documents are inserted into a PDF malware, the classifier must still classify it as malicious. We demonstrate how the worst-case behavior of a malware classifier with respect to specific robustness properties can be formally verified. Furthermore, we find that training classifiers that satisfy formally verified robustness properties can increase the evasion cost of unbounded (i.e., not bounded by the robustness properties) attackers by eliminating simple evasion attacks.
Specifically, we propose a new distance metric that operates on the PDF tree structure and specify two classes of robustness properties including subtree insertions and deletions. We utilize state-of-the-art verifiably robust training method to build robust PDF malware classifiers. Our results show that, we can achieve 92.27% average verified robust accuracy over three properties, while maintaining 99.74% accuracy and 0.56% false positive rate. With simple robustness properties, our robust model maintains 7% higher robust accuracy than all the baseline models against unrestricted whitebox attacks. Moreover, the state-of-the-art and new adaptive evolutionary attackers need up to 10 times larger $L_0$ feature distance and 21 times more PDF basic mutations (e.g., inserting and deleting objects) to evade our robust model than the baselines.
△ Less
Submitted 3 December, 2019; v1 submitted 6 April, 2019;
originally announced April 2019.
-
NEUZZ: Efficient Fuzzing with Neural Program Smoothing
Authors:
Dongdong She,
Kexin Pei,
Dave Epstein,
Junfeng Yang,
Baishakhi Ray,
Suman Jana
Abstract:
Fuzzing has become the de facto standard technique for finding software vulnerabilities. However, even state-of-the-art fuzzers are not very efficient at finding hard-to-trigger software bugs. Most popular fuzzers use evolutionary guidance to generate inputs that can trigger different bugs. Such evolutionary algorithms, while fast and simple to implement, often get stuck in fruitless sequences of…
▽ More
Fuzzing has become the de facto standard technique for finding software vulnerabilities. However, even state-of-the-art fuzzers are not very efficient at finding hard-to-trigger software bugs. Most popular fuzzers use evolutionary guidance to generate inputs that can trigger different bugs. Such evolutionary algorithms, while fast and simple to implement, often get stuck in fruitless sequences of random mutations. Gradient-guided optimization presents a promising alternative to evolutionary guidance. Gradient-guided techniques have been shown to significantly outperform evolutionary algorithms at solving high-dimensional structured optimization problems in domains like machine learning by efficiently utilizing gradients or higher-order derivatives of the underlying function. However, gradient-guided approaches are not directly applicable to fuzzing as real-world program behaviors contain many discontinuities, plateaus, and ridges where the gradient-based methods often get stuck. We observe that this problem can be addressed by creating a smooth surrogate function approximating the discrete branching behavior of target program. In this paper, we propose a novel program smoothing technique using surrogate neural network models that can incrementally learn smooth approximations of a complex, real-world program's branching behaviors. We further demonstrate that such neural network models can be used together with gradient-guided input generation schemes to significantly improve the fuzzing efficiency. Our extensive evaluations demonstrate that NEUZZ significantly outperforms 10 state-of-the-art graybox fuzzers on 10 real-world programs both at finding new bugs and achieving higher edge coverage. NEUZZ found 31 unknown bugs that other fuzzers failed to find in 10 real world programs and achieved 3X more edge coverage than all of the tested graybox fuzzers for 24 hours running.
△ Less
Submitted 12 July, 2019; v1 submitted 15 July, 2018;
originally announced July 2018.
-
Chiral magnetic currents with QGP medium response in heavy ion collisions at RHIC and LHC energies
Authors:
Duan She,
Sheng-Qin Feng,
Yang Zhong,
Zhong-Bao Yin
Abstract:
We calculate the electromagnetic current with a more realistic approach in the RHIC and LHC energy regions in the article. We take the partons formation time as the initial time of the magnetic field response of QGP medium. The maximum electromagnetic current and the time-integrated current are two important characteristics of the chiral magnetic effect (CME), which can characterize the intensity…
▽ More
We calculate the electromagnetic current with a more realistic approach in the RHIC and LHC energy regions in the article. We take the partons formation time as the initial time of the magnetic field response of QGP medium. The maximum electromagnetic current and the time-integrated current are two important characteristics of the chiral magnetic effect (CME), which can characterize the intensity and duration of fluctuations of CME. We consider the finite frequency response of CME to a time-varying magnetic field, find a significant impact from QGP medium feedback, and estimate the generated electromagnetic current as a function of time, beam energy and impact parameter.
△ Less
Submitted 25 March, 2018; v1 submitted 14 September, 2017;
originally announced September 2017.
