Can I read DifFuzzAR: automatic repair of timing side-channel vulnerabilities via refactoring on EtoBox?

DifFuzzAR: automatic repair of timing side-channel vulnerabilities via refactoring by Rui Lima; João F. Ferreira; Alexandra Mendes; Carolina Carreira is a Computer Science article available to read on EtoBox.

What is DifFuzzAR: automatic repair of timing side-channel vulnerabilities via refactoring about?

## Abstract Vulnerability detection and repair is a demanding and expensive part of the software development process. As such, there has been an effort to develop new and better ways to automatically detect and repair vulnerabilities. DifFuzz is a state-of-the-art tool for automatic detection of timing side-channel vulnerabilities, a type of vulnerability that is particularly difficult to detect and correct. Despite recent progress made with tools such as DifFuzz, work on tools capable of automatically repairing timing side-channel vulnerabilities is scarce. In this paper, we propose DifFuzzAR, a tool for automatic repair of timing side-channel vulnerabilities in Java code. The tool works in conjunction with DifFuzz and it is able to repair 56% of the vulnerabilities identified in DifFuzz’s dataset. The results show that the tool can automatically correct timing side-channel vulnerabilities, being more effective with those that are control-flow based. In addition, the results of a user study show that users generally trust the refactorings produced by DifFuzzAR and that they see value in such a tool, in particular for more critical code.

Who reads DifFuzzAR: automatic repair of timing side-channel vulnerabilities via refactoring?

Author

Rui Lima; João F. Ferreira; Alexandra Mendes; Carolina Carreira

Publisher

Springer Science and Business Media LLC

Published

2023

Language

EN

Field

Computer Science (Physical Sciences)