Automatic annotation of confidential data in java code

Bastys, Iulia, Bolignano, Pauline, Raimondi, Franco ORCID logoORCID: https://orcid.org/0000-0002-9508-7713 and Schoepe, Daniel (2021) Automatic annotation of confidential data in java code. In: FPS 2021: The 14th International Symposium on Foundations & Practice of Security, 08-12 Dec 2021, Paris, France. . ISSN 0302-9743 [Conference or Workshop Item]

[img] PDF - Final accepted version (with author's formatting)
Restricted to Repository staff and depositor only

Download (309kB)

Abstract

The problem of confidential information leak can be addressed by using automatic tools that take a set of annotated inputs
(the source) and track their flow to public sinks. Unfortunately, manually annotating the code with labels specifying the secret sources is one of the main obstacles in the adoption of such trackers.
In this work, we present an approach for the automatic generation of labels for confidential data in Java programs. Our solution is based on a graph-based representation of Java methods: starting from a minimal set of known API calls, it propagates the labels both intra- and inter-procedurally until a fix-point is reached. In our evaluation, we encode our synthesis and propagation algorithm in Datalog and assess the accuracy of our technique on seven previously annotated internal code bases, where we can reconstruct 75% of the pre-existing manual annotations. In addition to this single data point, we also perform an assessment using samples from the SecuriBench-micro benchmark, and we provide additional sample programs that demonstrate the capabilities and the limitations of our approach.

Item Type: Conference or Workshop Item (Paper)
Research Areas: A. > School of Science and Technology > Computer Science
Item ID: 34598
Notes on copyright: This version of the contribution has been accepted for publication, after peer review (when applicable) but is not the Version of Record and does not reflect post-acceptance improvements, or any corrections. The Version of Record is available online at: http://dx.doi.org/[insert DOI]. Use of this Accepted Version is subject to the publisher’s Accepted Manuscript terms of use https://www.springernature.com/gp/open-research/policies/accepted-manuscript-terms
Useful Links:
Depositing User: Franco Raimondi
Date Deposited: 25 Jan 2022 15:04
Last Modified: 06 Jun 2022 13:50
URI: https://eprints.mdx.ac.uk/id/eprint/34598

Actions (login required)

View Item View Item

Statistics

Activity Overview
6 month trend
1Download
6 month trend
34Hits

Additional statistics are available via IRStats2.