Attack Synthesis for Strings using Meta-Heuristics

Abstract

Information leaks are a significant problem in modern computer systems and string manipulation is prevalent in modern software. We present techniques for automated synthesis of side-channel attacks that recover secret string values based on timing observations on string manipulating code. Our attack synthesis techniques iteratively generate inputs which, when fed to code that accesses the secret, reveal partial information about the secret based on the timing observations, leading to recovery of the secret at the end of the attack sequence. We use symbolic execution to extract path constraints, automata-based model counting to estimate the probability of execution paths, and meta-heuristic methods to maximize information gain based on entropy for synthesizing adaptive attack steps.

Incremental Attack Synthesis

“…Preliminary results from this paper were discussed in a short workshop paper [28] which did not include our results on incremental attack synthesis and real world scenarios but was focused on studying different meta-heuristic techniques such as random search, genetic algorithm, and simulated annealing.…”

“…A slightly more sophisticated approach is to generate random samples using C l , compute the expected information gain for each of them using Equation (3) (i.e., objective function is evaluated using the automata-based entropy computation) and then choose the best one. [28] evaluates different meta heuristic techniques : genetic algorithm (GA) and simulated annealing (SA) to maximize information leakage and shows that SA performs better than GA. The reason is GA applies mutation and crossover to generate candidate low values.…”