Effective Program Debloating via Reinforcement Learning

Heo, Kihong; Lee, Woosuk; Pashakhanloo, Pardis; Naik, Mayur

doi:10.1145/3243734.3243838

Cited by 90 publications

(56 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…While these techniques can be helpful for applications where trace information is available, both works (1) require post-hoc analysis of program traces, and do not automatically adapt their policies in real time, and (2) minimize time spent in GC mechanisms, as opposed to optimizing a user-defined reward function (e.g., request latency). Many previous works have applied reinforcement learning to various systems problems, including query optimization [22,28], cluster scheduling [20], stream processing [29], software debloating [8], and cloud provisioning [21,27].…”

Section: Related Workmentioning

confidence: 99%

Learned garbage collection

Cen

Marcus

Mao

et al. 2020

Proceedings of the 4th ACM SIGPLAN International Workshop on Machine Learning and Programming Languages

View full text Add to dashboard Cite

Several programming languages use garbage collectors (GCs) to automatically manage memory for the programmer. Such collectors must decide when to look for unreachable objects to free, which can have a large performance impact on some applications. In this preliminary work, we propose a design for a learned garbage collector that autonomously learns over time when to perform collections. By using reinforcement learning, our design can incorporate user-defined reward functions, allowing an autonomous garbage collector to learn to optimize the exact metric the user desires (e.g., request latency or queries per second). We conduct an initial experimental study on a prototype, demonstrating that an approach based on tabular Q learning may be promising.

show abstract

Section: Related Workmentioning

confidence: 99%

Learned garbage collection

Cen

Marcus

Mao

et al. 2020

Proceedings of the 4th ACM SIGPLAN International Workshop on Machine Learning and Programming Languages

View full text Add to dashboard Cite

show abstract

“…Additionally, it does not scale and did not even terminate when removing a feature from the echo application of coreutils. Chisel [22] aims to support programmers to debloat programs. It needs the source code and a high-level specification of its functionalities to remove unwanted features with the help of delta debugging.…”

Section: Related Workmentioning

confidence: 99%

Towards Automated Application-Specific Software Stacks

Davidsson

Pawlowski

Holz

2019

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Software complexity has increased over the years. One common way to tackle this complexity during development is to encapsulate features into a shared library. This allows developers to reuse already implemented features instead of reimplementing them over and over again. However, not all features provided by a shared library are actually used by an application. As a result, an application using shared libraries loads unused code into memory, which an attacker can use to perform code-reuse and similar types of attacks. The same holds for applications written in a scripting language such as PHP or Ruby: The interpreter typically offers much more functionality than is actually required by the application and hence provides a larger overall attack surface.In this paper, we tackle this problem and propose a first step towards automated application-specific software stacks. We present a compiler extension capable of removing unneeded code from shared libraries and-with the help of domain knowledgealso capable of removing unused functionalities from an interpreter's code base during the compilation process. Our evaluation against a diverse set of real-world applications, among others Nginx, Lighttpd, and the PHP interpreter, removes on average 71.3% of the code in musl-libc, a popular libc implementation. The evaluation on web applications show that a tailored PHP interpreter can mitigate entire vulnerability classes, as is the case for OpenConf. We demonstrate the applicability of our debloating approach by creating an application-specific software stack for a Wordpress web application: we tailor the libc library to the Nginx web server and PHP interpreter, whereas the PHP interpreter is tailored to the Wordpress web application. In this real-world scenario, the code of the libc is decreased by 65.1% in total, thereby reducing the available code for code-reuse attacks.

show abstract

“…Existing feature-based debloating techniques require complex specifications and advanced software analysis techniques which have a high technical barrier to entry for the typical end user. For example, CHISEL [3] requires a test script that compiles the source code, executes it with inputs corresponding to desired and undesired features, and tests the output of each run to determine if the resulting program is correct [14]. Even for small programs, CHISEL requires long, complex scripts that test a large number of concrete inputs to produce debloated variants.…”

Section: Several Debloating Techniquesmentioning

confidence: 99%

“…Gadget introduction can negatively impact security, and multiple debloating and analysis iterations may be required to achieve a desirable result. Techniques such as CHISEL are not well suited for this task, as debloating operations can take hours to complete [3].…”

Section: Several Debloating Techniquesmentioning

confidence: 99%

“…Feature-based debloating techniques must perform two tasks: mapping software features to the source code that implements them and removing feature code according to the end user's needs. Existing techniques [2,3] employ dynamic analysis methods to accomplish both tasks in tandem when the debloater is invoked. Feature mapping is accomplished by executing the program with concrete inputs corresponding to features, and analyzing the resulting execution paths or program output.…”

Section: Designmentioning

confidence: 99%

See 1 more Smart Citation

Carve

Brown

Pande

2019

Proceedings of the 3rd ACM Workshop on Forming an Ecosystem Around Software Transformation

View full text Add to dashboard Cite

Software debloating is an emerging field of study aimed at improving the security and performance of software by removing excess library code and features that are not needed by the end user (called bloat). Software bloat is pervasive, and several debloating techniques have been proposed to address this problem. While these techniques are effective at removing bloat, they are not practical for the average end user, risk creating unsound programs and introducing new vulnerabilities, and are not well suited for debloating complex software such as network protocol implementations. In this paper, we propose CARVE, a simple yet effective securityfocused debloating technique that addresses these shortcomings. CARVE employs static source code annotation to map software features to source code, eliminating the need for advanced software analysis during debloating and reducing the overall level of technical sophistication required by the end user. CARVE also introduces the concept of debloating with replacement, which is capable of removing software features while preserving software interoperability and mitigating the risk of creating an unsound program or introducing a vulnerability. We evaluate CARVE in 12 debloating scenarios and present our results demonstrating security and performance improvements that meet or exceed those of existing techniques. CCS CONCEPTS • Security and privacy ® Software security engineering;

show abstract

Effective Program Debloating via Reinforcement Learning

Cited by 90 publications

References 24 publications

Learned garbage collection

Learned garbage collection

Towards Automated Application-Specific Software Stacks

Carve

Contact Info

Product

Resources

About