Automatic input rectification
We present a novel technique, automatic input rectification, and a prototype implementation, SOAP. SOAP learns a set of constraints characterizing typical inputs that an application is highly likely to process correctly. When given an atypical input that does not satisfy these constraints, SOAP auto...
| Main Authors: | , , , , |
|---|---|
| Other Authors: | |
| Format: | Article |
| Language: | en_US |
| Published: |
Institute of Electrical and Electronics Engineers (IEEE)
2014
|
| Online Access: | http://hdl.handle.net/1721.1/90583 https://orcid.org/0000-0001-8095-8523 |
| _version_ | 1826213739839356928 |
|---|---|
| author | Long, Fan Ganesh, Vijay Carbin, Michael James Sidiroglou, Stelios Rinard, Martin |
| author2 | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory |
| author_facet | Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory Long, Fan Ganesh, Vijay Carbin, Michael James Sidiroglou, Stelios Rinard, Martin |
| author_sort | Long, Fan |
| collection | MIT |
| description | We present a novel technique, automatic input rectification, and a prototype implementation, SOAP. SOAP learns a set of constraints characterizing typical inputs that an application is highly likely to process correctly. When given an atypical input that does not satisfy these constraints, SOAP automatically rectifies the input (i.e., changes the input so that it satisfies the learned constraints). The goal is to automatically convert potentially dangerous inputs into typical inputs that the program is highly likely to process correctly. Our experimental results show that, for a set of benchmark applications (Google Picasa, ImageMagick, VLC, Swfdec, and Dillo), this approach effectively converts malicious inputs (which successfully exploit vulnerabilities in the application) into benign inputs that the application processes correctly. Moreover, a manual code analysis shows that, if an input does satisfy the learned constraints, it is incapable of exploiting these vulnerabilities. We also present the results of a user study designed to evaluate the subjective perceptual quality of outputs from benign but atypical inputs that have been automatically rectified by SOAP to conform to the learned constraints. Specifically, we obtained benign inputs that violate learned constraints, used our input rectifier to obtain rectified inputs, then paid Amazon Mechanical Turk users to provide their subjective qualitative perception of the difference between the outputs from the original and rectified inputs. The results indicate that rectification can often preserve much, and in many cases all, of the desirable data in the original input. |
| first_indexed | 2024-09-23T15:54:03Z |
| format | Article |
| id | mit-1721.1/90583 |
| institution | Massachusetts Institute of Technology |
| language | en_US |
| last_indexed | 2024-09-23T15:54:03Z |
| publishDate | 2014 |
| publisher | Institute of Electrical and Electronics Engineers (IEEE) |
| record_format | dspace |
| spelling | mit-1721.1/905832022-10-02T04:56:14Z Automatic input rectification Long, Fan Ganesh, Vijay Carbin, Michael James Sidiroglou, Stelios Rinard, Martin Massachusetts Institute of Technology. Computer Science and Artificial Intelligence Laboratory Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science Long, Fan Ganesh, Vijay Carbin, Michael James Sidiroglou, Stelios Rinard, Martin We present a novel technique, automatic input rectification, and a prototype implementation, SOAP. SOAP learns a set of constraints characterizing typical inputs that an application is highly likely to process correctly. When given an atypical input that does not satisfy these constraints, SOAP automatically rectifies the input (i.e., changes the input so that it satisfies the learned constraints). The goal is to automatically convert potentially dangerous inputs into typical inputs that the program is highly likely to process correctly. Our experimental results show that, for a set of benchmark applications (Google Picasa, ImageMagick, VLC, Swfdec, and Dillo), this approach effectively converts malicious inputs (which successfully exploit vulnerabilities in the application) into benign inputs that the application processes correctly. Moreover, a manual code analysis shows that, if an input does satisfy the learned constraints, it is incapable of exploiting these vulnerabilities. We also present the results of a user study designed to evaluate the subjective perceptual quality of outputs from benign but atypical inputs that have been automatically rectified by SOAP to conform to the learned constraints. Specifically, we obtained benign inputs that violate learned constraints, used our input rectifier to obtain rectified inputs, then paid Amazon Mechanical Turk users to provide their subjective qualitative perception of the difference between the outputs from the original and rectified inputs. The results indicate that rectification can often preserve much, and in many cases all, of the desirable data in the original input. National Science Foundation (U.S.) (Grant CCF-0811397) National Science Foundation (U.S.) (Grant CCF-0905244) National Science Foundation (U.S.) (Grant CCF-1036241) National Science Foundation (U.S.) (Grant IIS-0835652) United States. Dept. of Energy (DOE grant DE-SC0005288) United States. Defense Advanced Research Projects Agency (DARPA Grant FA8650-11-C- 7192) United States. Defense Advanced Research Projects Agency (DARPA Grant FA8750-12-2-0110) 2014-10-07T17:14:12Z 2014-10-07T17:14:12Z 2012-06 Article http://purl.org/eprint/type/ConferencePaper 978-1-4673-1067-3 978-1-4673-1066-6 978-1-4673-1065-9 0270-5257 INSPEC Accession Number: 12847757 http://hdl.handle.net/1721.1/90583 Long, Fan, Vijay Ganesh, Michael Carbin, Stelios Sidiroglou, and Martin Rinard. “Automatic Input Rectification.” 2012 34th International Conference on Software Engineering (ICSE) (June 2012). IEEE, p.80-90. https://orcid.org/0000-0001-8095-8523 en_US http://dx.doi.org/10.1109/ICSE.2012.6227204 2012 34th International Conference on Software Engineering (ICSE) Creative Commons Attribution-Noncommercial-Share Alike http://creativecommons.org/licenses/by-nc-sa/4.0/ application/pdf Institute of Electrical and Electronics Engineers (IEEE) MIT web domain |
| spellingShingle | Long, Fan Ganesh, Vijay Carbin, Michael James Sidiroglou, Stelios Rinard, Martin Automatic input rectification |
| title | Automatic input rectification |
| title_full | Automatic input rectification |
| title_fullStr | Automatic input rectification |
| title_full_unstemmed | Automatic input rectification |
| title_short | Automatic input rectification |
| title_sort | automatic input rectification |
| url | http://hdl.handle.net/1721.1/90583 https://orcid.org/0000-0001-8095-8523 |
| work_keys_str_mv | AT longfan automaticinputrectification AT ganeshvijay automaticinputrectification AT carbinmichaeljames automaticinputrectification AT sidirogloustelios automaticinputrectification AT rinardmartin automaticinputrectification |