precise dynamic data flow tracking with proximal gradients · 2020-04-30 · huffman decoding index...

Gabriel Ryan 1 , Abhishek Shah 1 , Dongdong She 1 , Koustubha Bhat 2 , Suman Jana 1 1 Columbia University 2 Vrije Universiteit [email protected], [email protected], [email protected], [email protected], [email protected] References: [1] LeCun, Yann, Yoshua Bengio, and Geoffrey Hinton. "Deep learning." nature 521.7553 (2015): 436. [2] Selvaraju, Ramprasaath R., et al. "Grad-cam: Visual explanations from deep networks via gradient- based localization." Proceedings of the IEEE International Conference on Computer Vision. 2017. [3] Parikh, Neal, and Stephen Boyd. "Proximal algorithms." Foundations and Trends® in Optimization 1.3 (2014): 127-239. Gradient provides more precise and meaningful information about program behavior than taint based dataflow tracking. Gradient can be used to guide searches over large input spaces. Evaluation: - Achieved up to 39% better dataflow precision than state of the art method (Taint Analysis) on 7 programs. - Overhead is comparable to Taint Analysis on average (<5%). - Example application: Dataflow guided fuzzing. - Increase of 57% edge coverage on 2 programs Figure 1. Gradient avoids approximation errors and identifies where x has the greatest effect on y. Precise Dynamic Data Flow Tracking with Proximal Gradients Problem: Programs are not Differentiable Solution: Nonsmooth Optimization Programs contain nonsmooth operations like Bitwise And, making it impossible to compute gradients normally. Proximal Gradients are an application of nonsmooth optimization methods that base the gradient on the local minimum of a function. 3 int f(int x) { return x & 4; } x=6 Local gradient is flat! x=6 x=6 Proximal Minimization Proximal Gradient Proximal Operator finds nearby minimum Proximal Gradient is computed from nearby minimum input byte decoding byte Gradient Analysis identifies which input bytes are used to look up each Huffman decoding index in gzip decompression. taint source: x taint sink: y // x is a 4 byte int int x = 0x12345678; for (int i=0; i<6; i++){ y[i] = x; x = x<<8; } Taint to y from x Gradient of y wrt. x y 1 1 1 1 1 1 1 256 2^16 2^24 0 0 gradient input[0] input[1] Error! y=2*x y_shad = alloc_shadow() y_grad = gradient(2 * x) Application Memory Gradient Table Application Code Shadow Memory Instrumentation Code Implementation: - Implemented as LLVM Sanitizer, based on DataFlowSanitizer - Each address has associated shadow memory with label - Each operation is instrumented to propagate gradient

Upload: others

Post on 14-Jul-2020

4 views

Category:

Documents

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Page 1: Precise Dynamic Data Flow Tracking with Proximal Gradients · 2020-04-30 · Huffman decoding index in gzip decompression. taint source: x taint sink: y // x is a 4 byte int int x

Gabriel Ryan1, Abhishek Shah1, Dongdong She1, Koustubha Bhat2, Suman Jana1

1Columbia University 2Vrije [email protected], [email protected], [email protected], [email protected], [email protected]

References:[1] LeCun, Yann, Yoshua Bengio, and Geoffrey Hinton. "Deep learning." nature 521.7553 (2015): 436.[2] Selvaraju, Ramprasaath R., et al. "Grad-cam: Visual explanations from deep networks via gradient-based localization." Proceedings of the IEEE International Conference on Computer Vision. 2017.[3] Parikh, Neal, and Stephen Boyd. "Proximal algorithms." Foundations and Trends® in Optimization 1.3 (2014): 127-239.

Gradient provides more precise and meaningful information about programbehavior than taint based dataflow tracking.

Gradient can be used toguide searches over large input spaces.

Evaluation:- Achieved up to 39% better dataflow precision than

state of the art method (Taint Analysis) on 7 programs.

- Overhead is comparable to Taint Analysis on average (<5%).- Example application: Dataflow guided fuzzing.

- Increase of 57% edge coverage on 2 programs

Figure 1. Gradient avoids approximation errorsand identifies where x has the greatest effect on y.

Precise Dynamic Data Flow Tracking with Proximal Gradients

Problem: Programs are not Differentiable

Solution: Nonsmooth Optimization

Programs contain nonsmooth operations like Bitwise And,making it impossible to compute gradients normally.

Proximal Gradients are an application of nonsmoothoptimization methods that base the gradient on the localminimum of a function.3

int f(int x) return x & 4;

x=6

Local gradient is flat!

x=6 x=6

Proximal Minimization Proximal Gradient

Proximal Operator finds nearby minimum

Proximal Gradient is computed from nearby minimum

inpu

t by

decoding byte

Gradient Analysis identifies which input bytes are used to look up each Huffman decoding index in gzipdecompression.

taint source: xtaint sink: y// x is a 4 byte intint x = 0x12345678;for (int i=0; i<6; i++) y[i] = x; x = x<<8;

Taint to y from x

Gradient of y wrt. x

y1 1 1 1 1 1

1 256 2^16 2^24 0 0gradient

input[0]

input[1]

Error!

y = 2 * x

y_shad = alloc_shadow() y_grad = gradient(2 * x)

Application Memory

Gradient Table

Application Code

Shadow MemoryInstrumentation Code

Implementation:- Implemented as LLVM Sanitizer, based on DataFlowSanitizer- Each address has associated shadow memory with label- Each operation is instrumented to propagate gradient

Minnet (=stacken) public static int fac(int n) { if (n == 0) return 1; else return fac(n-1) * n; }..... main(String [] a) { int x; x = fac(3); System.out.println(x);

Verifying Quantitative Reliability for Programs That ...people.csail.mit.edu/misailo/papers/rely13.pdf · tion signature int f(int x, int y, int z), where 0.99*R(x,

Passing arguments by value void func (int x) { x = 4; }... int a = 10;... func(a); cout

Variable = expression type name; int x;x____________________ int y;y____________________ int z;z____________________

UniversityofWashington* Using leal*for*Arithme3c*Expressions*...UniversityofWashington* Using leal*for*Arithme3c*Expressions* int arith (int x, int y, int z) { int t1 = x+y; int t2

TDDD38/726G82- Advancedprogrammingin C++TDDD38/lecture/slides/inheritance.pdf · 4/35 Inheritance Protectedmembers class Base {public: Base(int x): x{x} { } protected: int x;}; struct

Nishi Taint Eco 090811

CS102: Functionsvenus.cs.qc.cuny.edu/~cwang/102/lecture09.pdf · Pass by reference: square(x) //prototype void square(int x, int &y); //implementation void square(int x, int &y){y=x*x;}

C++ Inheritanceweb.mit.edu/6.s096/www/iap13/lectures/6/6.s096-lecture6.pdf · C++ Inheritance. Bits & Bobs. int x; int y; int int x y struct {int x; int y;} pt; int int pt.x pt.y

X-gateway - XOLogicX-gateway Int 1. EtherNet/IP Adapter Int 2. Profibus Master CC-Link IE Field X-gateway Int 1. CC-Link IE Field Slave Int 2. Profinet Device PROFINET HMS provides

Compilers - James Madison University · – CS 327, CS 430 Graph algorithms ... def int add(int x, int y) {return x + y;} def int main() {int a; a = 3; return add(a, 2);} $ java -jar

Taint scope