{"id":3740,"date":"2019-12-10T09:47:23","date_gmt":"2019-12-10T01:02:23","guid":{"rendered":"https:\/\/www.inforsec.org\/wp\/?p=3740"},"modified":"2019-12-27T09:18:47","modified_gmt":"2019-12-27T00:33:47","slug":"%e8%a5%bf%e5%ae%89%e4%ba%a4%e9%80%9a%e5%a4%a7%e5%ad%a6%e7%bd%91%e7%bb%9c%e5%ae%89%e5%85%a8%e7%a0%94%e7%a9%b6%e5%9b%bd%e9%99%85%e5%ad%a6%e6%9c%af%e8%ae%ba%e5%9d%9b","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=3740","title":{"rendered":"\u3010InForSec\u6d3b\u52a8\u9884\u544a\u3011\u897f\u5b89\u4ea4\u901a\u5927\u5b66\u7f51\u7edc\u5b89\u5168\u7814\u7a76\u56fd\u9645\u5b66\u672f\u8bba\u575b"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\"><strong>\u4e3b\u529e\uff1a\u897f\u5b89\u4ea4\u901a\u5927\u5b66\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u5b66\u9662<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u534f\u529e\uff1a\u7f51\u5b89\u56fd\u9645\u8bba\u575b\uff08InForSec\uff09<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>          \u9655\u897f\u7701\u8ba1\u7b97\u673a\u5b66\u4f1a\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u4e13\u59d4\u4f1a<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>         \u5317\u4eac\u4fe1\u606f\u79d1\u5b66\u4e0e\u6280\u672f\u56fd\u5bb6\u7814\u7a76\u4e2d\u5fc3<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u65f6\u95f4\uff1a12\u670814\u65e5\uff08\u5468\u516d\uff09\u4e0b\u534813:30~18:10<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5730\u70b9\uff1a\u897f\u5b89\u4ea4\u901a\u5927\u5b66\u5174\u5e86\u6821\u533a\u79d1\u5b66\u9986101 <\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\" style=\"text-align:center\"><strong>\u4f1a\u8bae\u65e5\u7a0b<\/strong><\/p>\n\n\n\n<div class=\"wp-block-image\"><figure class=\"aligncenter\"><img loading=\"lazy\" decoding=\"async\" width=\"571\" height=\"505\" src=\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2019\/12\/image.png\" alt=\"\" class=\"wp-image-3741\" srcset=\"http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/image.png 571w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/image-300x265.png 300w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/image-150x133.png 150w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/image-170x150.png 170w\" sizes=\"auto, (max-width: 571px) 100vw, 571px\" \/><figcaption><br><\/figcaption><\/figure><\/div>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5609\u5bbe\u7b80\u4ecb<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72471-1.png\" alt=\"\" class=\"wp-image-3742\" width=\"165\" height=\"165\" srcset=\"http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72471-1.png 660w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72471-1-150x150.png 150w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72471-1-300x300.png 300w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72471-1-200x200.png 200w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72471-1-144x144.png 144w\" sizes=\"auto, (max-width: 165px) 100vw, 165px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">1\u3001\u6f14\u8bb2\u5609\u5bbe\uff1a\u6d2a\u6653\u9e4f &nbsp;\u897f\u5b89\u4ea4\u901a\u5927\u5b66\u7279\u8058\u7814\u7a76\u5458\uff0c\u535a\u58eb\u751f\u5bfc\u5e08<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f14\u8bb2\u9898\u76ee\uff1a<\/strong>&nbsp;\u667a\u80fd\u5b89\u9632\u4e4b\u81ea\u52a8\u5fae\u8868\u60c5\u5206\u6790\uff1a\u4ece\u624b\u5de5\u7279\u5f81\u5230\u6df1\u5ea6\u5b66\u4e60<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5185\u5bb9\u6458\u8981\uff1a<\/strong>\u5fae\u8868\u60c5\u662f\u4e00\u79cd\u6301\u7eed\u65f6\u95f4\u975e\u5e38\u7b80\u77ed\u7684\u81ea\u53d1\u4eba\u7c7b\u8138\u90e8\u8868\u60c5\u3002\u5b83\u662f\u4e00\u79cd\u81ea\u53d1\u6027\u7684\u975e\u81ea\u613f\u8868\u60c5\u52a8\u4f5c\uff0c\u5f80\u5f80\u53cd\u6620\u4e86\u4eba\u4eec\u5e0c\u671b\u9690\u85cf\u7684\u771f\u5b9e\u60c5\u611f\u6240\u4ee5\u4e0d\u5bb9\u6613\u5047\u5192\u3002\u56e0\u6b64\u81ea\u52a8\u68c0\u6d4b\u5e76\u8bc6\u522b\u8fd9\u4e9b\u8f6c\u77ac\u5373\u901d\u7684\u4fe1\u606f\u5728\u5b89\u9632\u3001\u533b\u7597\u3001\u5546\u4e1a\u7b49\u9886\u57df\u90fd\u5177\u6709\u5e7f\u6cdb\u7684\u5e94\u7528\u524d\u666f\u3002\u5fae\u8868\u60c5\u662f\u4eba\u7c7b\u8868\u8fbe\u81ea\u8eab\u60c5\u611f\u7684\u4e00\u79cd\u5e38\u89c1\u65b9\u5f0f\uff0c\u5374\u7531\u4e8e\u5176\u52a8\u4f5c\u5e45\u5ea6\u5c0f\u548c\u6301\u7eed\u65f6\u95f4\u77ed\uff0c\u96be\u4ee5\u5bdf\u89c9\u800c\u5e38\u88ab\u5ffd\u89c6\u3002\u8fd9\u4e5f\u4e3a\u81ea\u52a8\u5fae\u8868\u60c5\u5206\u6790\u5e26\u6765\u4e86\u6781\u5927\u7684\u6311\u6218\u3002\u9488\u5bf9\u8fd9\u4e9b\u6311\u6218\uff0c\u62a5\u544a\u4eba\u5728\u81ea\u52a8\u5fae\u8868\u60c5\u5206\u6790\u65b9\u5411\u4e0a\u5f00\u5c55\u4e86\u591a\u5e74\u7814\u7a76\u3002\u672c\u6b21\u62a5\u544a\u5c06\u7b80\u8981\u6c47\u62a5\u5176\u5728\u76f8\u5173\u65b9\u9762\u7684\u4e3b\u8981\u5de5\u4f5c\uff0c\u5305\u62ec\uff08\u4e00\uff09\u5fae\u8868\u60c5\u8bc6\u522b\u548c\u5206\u6790\u7684\u6570\u636e\u5e93\u91c7\u96c6\u548c\u6d4b\u8bd5\u6807\u51c6\u5efa\u7acb\u3001\uff08\u4e8c\uff09\u5fae\u8868\u60c5\u8bc6\u522b\u6846\u67b6\u3001\uff08\u4e09\uff09\u57fa\u4e8e\u6df1\u5ea6\u5b66\u4e60\u7684\u5fae\u8868\u60c5\u68c0\u6d4b\u4e0e\u8bc6\u522b\u7b97\u6cd5\u3001\uff08\u56db\uff09\u5229\u7528\u591a\u6a21\u6001\u3001\u8de8\u6570\u636e\u96c6\u7b49\u7814\u7a76\u8303\u5f0f\u89e3\u51b3\u5c0f\u6837\u672c\u95ee\u9898\u7684\u5c1d\u8bd5\u5e76\u63a2\u8ba8\u672a\u6765\u7684\u7814\u7a76\u8d8b\u52bf\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f14\u8bb2\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6d2a\u6653\u9e4f\u535a\u58eb\uff0c\u897f\u5b89\u4ea4\u901a\u5927\u5b66\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u5b66\u9662\u7279\u8058\u7814\u7a76\u5458\u3001\u535a\u5bfc\u3002\u66fe\u83b7\u82ac\u5170\u5965\u5362\u5927\u5b66Docent\uff08\u82ac\u5170\u526f\u9ad8\u3001\u535a\u58eb\u751f\u5bfc\u5e08\uff09\u5934\u8854\u3002\u5728\u5982TPAMI\u3001TIP\u7b49IEEE\/ACM\u4f1a\u520a\u548cCVPR\u3001ICCV\u7b49CCF A\u7c7b\u5b66\u672f\u4f1a\u8bae\u4e0a\u53d1\u8868\u6587\u7ae030\u4f59\u7bc7\u3002\u6240\u53d1\u8868\u6587\u7ae0\u8c37\u6b4c\u5b66\u672f\u5f15\u7528\u903e\u5343\u6b21\uff0c\u5355\u7bc7\u6240\u8f7d\u520a\u7269\u6700\u9ad8\u5f71\u54cd\u56e0\u5b5017.73\u3002\u5176\u5728\u5fae\u8868\u60c5\u5206\u6790\u65b9\u9762\u7684\u76f8\u5173\u5de5\u4f5c\u89c1\u8bf8\u7f8e\u56fd\u300a\u9ebb\u7701\u7406\u5de5\u6280\u672f\u8bc4\u8bba\u300b\u548c\u82f1\u56fd\u300a\u6bcf\u65e5\u90ae\u62a5\u300b\u7b49\u56fd\u9645\u6743\u5a01\u5a92\u4f53\u4e13\u6587\u62a5\u9053\u3002\u81ea2011\u5e74\u8d77\u4e3b\u6301\u82ac\u5170\u4fe1\u606f\u6280\u672f\u5b66\u4f1a(Infotech)\u535a\u58eb\u540e\u79d1\u7814\u57fa\u91d1\u9879\u76ee\u4e00\u9879\uff0c\u5171\u540c\u4e3b\u6301\u82ac\u5170\u79d1\u5b66\u9662ICT2023\u4e13\u9898\u9879\u76ee\u4e00\u9879\u3002\u4ed6\u662fIEEE\u4f1a\u5458\uff0c\u591a\u6b21\u53d7\u9080\u62c5\u4efb\u5982IEEE T-PAMI\u3001T-IP\u3001T-NN\u53caIJCV\u7b49\u91cd\u8981\u56fd\u9645\u5b66\u672f\u671f\u520a\u548cICCV\u53caCVPR\u7b49\u91cd\u8981\u56fd\u9645\u5b66\u672f\u4f1a\u8bae\u7684\u5ba1\u7a3f\u4eba\u3002\u6b64\u5916\uff0c\u4e0e\u540c\u884c\u5728\u4e3b\u6d41\u56fd\u9645\u4f1a\u8bae\u4e0a\u5148\u540e\u4e3e\u529e\u4e86\u591a\u573a\u4e13\u9898\u7814\u8ba8\u4f1a\uff0c\u5e76\u53d7\u9080\u62c5\u4efb\u591a\u4e2a\u56fd\u9645\u4f1a\u8bae\u53ca\u4e13\u9898\u7684\u5206\u4f1a\u4e3b\u5e2d\u548c\u7a0b\u5e8f\u59d4\u5458\u4f1a\u6210\u5458\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">2\u3001\u6f14\u8bb2\u5609\u5bbe\uff1a\u674e\u4e00&nbsp;\u5357\u6d0b\u7406\u5de5\u5927\u5b66\u52a9\u7406\u6559\u6388<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f14\u8bb2\u4e3b\u9898: Towards Secure and Robust Stateful Deep Learning Systems<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5185\u5bb9\u6458\u8981\uff1a<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Despite the tremendous success in cutting-edge applications, Deep Learning (DL) still suffers from quality and security issues. While some recent progress has been made on analyzing feed-forward DL systems, limited analysis has been done on stateful DL systems such as the Recurrent Neural Network (RNN), which are widely used in audio, natural languages and video processing, etc. In this talk, I will present our recent research results on the quantitative analysis of RNN-based DL systems, with DeepStellar focusing on the security properties and MARBLE on the robustness properties. We demonstrate through experimental evaluation that DeepStellar and MARBLE can boost the effectiveness and efficiency of fuzz testing, adversarial example detection and generation for RNNs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f14\u8bb2\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Yi Li is an Assistant Professor from the School of Computer Science and Engineering at the Nanyang Technological University, Singapore. He received his M.Sc. and Ph.D. in Computer Science from the University of Toronto in 2013 and 2018, respectively. Yi\u2019s research interests are in software engineering, software security, and software sustainability. He was the recipient of the Chinese Government Award for Outstanding Students Abroad in 2018. His recent work on software history analysis won an ACM Distinguished Paper Award at the 30th International Conference on Automated Software Engineering (ASE\u201915). He was co-chair of the ICFEM\u201919 Doctoral Symposium and served as a member of the program committee for ICDCS\u201920, VSTTE\u201919, ASE\u201919, SANER\u201919, SANER\u201920 and MOBILESoft\u201920 tool track. <\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72472-4.png\" alt=\"\" class=\"wp-image-3754\" width=\"123\" height=\"123\" srcset=\"http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72472-4.png 493w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72472-4-150x150.png 150w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72472-4-300x300.png 300w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72472-4-200x200.png 200w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72472-4-144x144.png 144w\" sizes=\"auto, (max-width: 123px) 100vw, 123px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">3\u3001\u6f14\u8bb2\u5609\u5bbe\uff1a\u5218\u4fdd\u541b &nbsp;&nbsp;\u6e05\u534e\u5927\u5b66\u7f51\u7edc\u79d1\u5b66\u4e0e\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f14\u8bb2\u4e3b\u9898:\u57df\u540d\u534f\u8bae\u5b89\u5168\u6d4b\u91cf\u7814\u7a76\uff1a\u4ece\u57df\u540d\u52ab\u6301\u5230\u57df\u540d\u52a0\u5bc6<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5185\u5bb9\u6458\u8981:<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u516c\u5171DNS\u670d\u52a1\u5668\u7531\u4e8e\u5176\u826f\u597d\u7684\u5b89\u5168\u6027\u88ab\u4e00\u4e9b\u4e92\u8054\u7f51\u7528\u6237\u6240\u4fe1\u4efb\u3002 \u6211\u4eec\u7814\u7a76\u53d1\u73b0\uff0c\u8fd9\u5c42\u4fe1\u4efb\u5173\u7cfb\u4f1a\u8f7b\u6613\u5730\u88ab\u57df\u540d\u89e3\u6790\u8def\u5f84\u52ab\u6301\u6240\u7834\u574f\u3002\u7f51\u7edc\u4e2d\u7684\u65c1\u8def\u8bbe\u5907\u53ef\u80fd\u4f1a\u4f2a\u88c5\u6210\u516c\u5171DNS\u670d\u52a1\u5668\u7684\u5730\u5740\uff0c\u8fdb\u800c\u52ab\u6301\u7528\u6237\u7684\u57df\u540d\u89e3\u6790\u6d41\u91cf\uff0c\u5e76\u8f6c\u53d1\u5230\u7b2c\u4e09\u65b9\u670d\u52a1\u5668\u3002\u901a\u8fc7\u5168\u7403\u8303\u56f4\u5185\u5927\u89c4\u6a21\u7684\u6d4b\u91cf\u7814\u7a76\uff0c\u6211\u4eec\u89c2\u6d4b\u5230\u5168\u7403\u4e24\u767e\u4f59\u4e2a\u81ea\u6cbb\u57df\u5185\u5b58\u5728\u8fd9\u79cd\u73b0\u8c61\uff1b\u800c\u5728\u4e2d\u56fd\uff0c\u8fd1\u4e09\u6210\u8c37\u6b4c\u516c\u5171DNS\u7684\u57df\u540d\u89e3\u6790\u6d41\u91cf\u88ab\u52ab\u6301\u3002\u8fd9\u4e00\u73b0\u8c61\u7ed9\u7528\u6237\u5e26\u6765\u4e86\u591a\u79cd\u5b89\u5168\u9690\u60a3\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"> &nbsp;&nbsp;\u4e3a\u89e3\u51b3DNS\u660e\u6587\u4f20\u8f93\u4e2d\u7684\u5b89\u5168\u4e0e\u9690\u79c1\u95ee\u9898\uff0c\u8fd1\u5e74\u6765\uff0c\u5b89\u5168\u793e\u533a\u63d0\u51fa\u591a\u79cd\u52a0\u5bc6DNS\u65b9\u6848\u3002DNS-over-TLS\u548cDNS-over-HTTPS\u4f5c\u4e3a\u5176\u4e2d\u7684\u4e24\u79cd\u6807\u51c6\u5316\u534f\u8bae\uff0c\u5f97\u5230\u4e86\u4e1a\u754c\u5e7f\u6cdb\u7684\u5173\u6ce8\u4e0e\u90e8\u7f72\u3002\u6211\u4eec\u4ece\u5168\u7403\u7528\u6237\u7684\u89c6\u89d2\u51fa\u53d1\uff0c\u5bf9\u5f53\u524d\u7684\u52a0\u5bc6DNS\u751f\u6001\u7cfb\u7edf\u8fdb\u884c\u4e86\u5927\u89c4\u6a21\u7684\u6d4b\u91cf\u7814\u7a76\u3002\u6211\u4eec\u53d1\u73b0\uff0c\u516c\u5171\u52a0\u5bc6DNS\u670d\u52a1\u5668\u5177\u6709\u826f\u597d\u7684\u53ef\u8fbe\u6027\uff0c\u4e14\u52a0\u5bc6\u73af\u8282\u5e76\u672a\u5f15\u5165\u663e\u8457\u7684\u6027\u80fd\u5f00\u9500\uff0c\u4e0e\u6b64\u540c\u65f6\uff0c\u52a0\u5bc6\u670d\u52a1\u63d0\u4f9b\u8005\u5b58\u5728\u5927\u91cf\u4e0d\u89c4\u8303\u7684\u5b9e\u73b0\u53ca\u8bef\u914d\u7f6e\u95ee\u9898\u3002\u6b64\u5916\uff0c\u5c3d\u7ba1\u5b9e\u9645\u7f51\u7edc\u4e2d\u52a0\u5bc6DNS\u6d41\u91cf\u4ecd\u7136\u8f83\u5c11\uff0c\u4f46\u5b58\u5728\u663e\u8457\u4e0a\u5347\u7684\u8d8b\u52bf\u3002\u7814\u7a76\u5de5\u4f5c\u5206\u522b\u53d1\u8868\u4e8e USENIX Security \u53ca IMC\uff0c\u5e76\u63d0\u540dIMC\u6700\u4f73\u8bba\u6587\u5956\u4e0e\u793e\u533a\u8d21\u732e\u5956\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f14\u8bb2\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5218\u4fdd\u541b\u662f\u6e05\u534e\u5927\u5b66\u8ba1\u7b97\u673a\u7cfb\u4e94\u5e74\u7ea7\u76f4\u535a\u751f\uff0c\u5bfc\u5e08\u4e3a\u5218\u83b9\u8001\u5e08\u4e0e\u6bb5\u6d77\u65b0\u8001\u5e08\uff0c2018\u5e74\u4e8e\u4f2f\u514b\u5229\u56fd\u9645\u8ba1\u7b97\u673a\u79d1\u5b66\u7814\u7a76\u6240\u8bbf\u95ee\u3002\u4e3b\u8981\u7814\u7a76\u65b9\u5411\u4e3a\u7f51\u7edc\u57fa\u7840\u8bbe\u65bd\u5b89\u5168\u3002\u535a\u58eb\u671f\u95f4\u5b66\u672f\u8bba\u6587\u53d1\u8868\u4e8eIEEE S&amp;P\u3001USENIX Security\u3001CCS\u3001NDSS\u3001IMC\u7b49\u56fd\u9645\u7f51\u7edc\u5b89\u5168\u9886\u57df\u91cd\u8981\u4f1a\u8bae\uff0c\u83b7\u5f97\u6e05\u534e\u5927\u5b66\u535a\u58eb\u751f\u56fd\u5bb6\u5956\u5b66\u91d1\u3001NDSS 2019\u6700\u4f73\u8bba\u6587\u5956\uff0cIMC 2019\u6700\u4f73\u8bba\u6587\u5956\u4e0e\u5b89\u5168\u793e\u533a\u8d21\u732e\u5956\u63d0\u540d\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72473-3.png\" alt=\"\" class=\"wp-image-3749\" width=\"106\" height=\"140\" srcset=\"http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72473-3.png 422w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72473-3-227x300.png 227w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72473-3-113x150.png 113w\" sizes=\"auto, (max-width: 106px) 100vw, 106px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">4\u3001\u6f14\u8bb2\u5609\u5bbe\uff1a\u738b\u6d77\u519b \u8682\u8681\u91d1\u670d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f14\u8bb2\u4e3b\u9898: Typestate-Guided Fuzzer for Discovering Use-after-Free Vulnerabilities<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5185\u5bb9\u6458\u8981\uff1a<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Existing coverage-based fuzzers usually use the individual control flow graph &nbsp;(CFG) edge coverage to guide the fuzzing process, which has shown great potential in finding vulnerabilities. However, CFG edge coverage is not effective in discovering vulnerabilities such as use-after-free (UaF). This is because, to trigger UaF vulnerabilities, one needs not only to cover individual edges, but also to traverse some long sequence of edges in a particular order, which is challenging for existing fuzzers. To this end, we first propose to model UaF vulnerabilities as typestate properties, then develop a typestate-guided fuzzer, named UAFL, for discovering vulnerabilities violating typestate properties. Given a typestate property, we first perform a static typestate analysis to find operation sequences potentially violating the property. Then, the fuzzing process is guided by the operation sequences in order to progressively generate test cases triggering property violations. In addition, we alsoadopt the information flow analysis to improve the efficiency of the fuzzing process. We performed a thorough evaluation of UAFL on 14 widely-used real-world programs. The experiment results show that UAFL substantially outperforms the state-of-the-art fuzzers,including AFL, AFLFast, FairFuzz, MOpt, Angora and QSYM, in terms of the time taken to discover vulnerabilities. We discovered 10 previously unknown vulnerabilities, and received 5 new CVEs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f14\u8bb2\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Haijun Wang is working in Ant Finacial, China. He received the Ph.D degree in School of Electronic and Information from Xi&#8217;an Jiaotong University, China, in 2016, and worked as PostDoc in school of computer science and engineering of Nanyang Technological University, Singapore. His research interests include program analysis, regression testing, reverse engineering, software security, blockchain security. His work has appeared at top-tier conference and journal, such as FSE, ICSE, ASE and TSE.<\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72474-2.png\" alt=\"\" class=\"wp-image-3748\" width=\"113\" height=\"113\" srcset=\"http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72474-2.png 450w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72474-2-150x150.png 150w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72474-2-300x300.png 300w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72474-2-200x200.png 200w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72474-2-144x144.png 144w\" sizes=\"auto, (max-width: 113px) 100vw, 113px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">5\u3001\u6f14\u8bb2\u5609\u5bbe\uff1a\u8bf8\u4e16\u901a \u52a0\u5dde\u5927\u5b66\u6cb3\u6ee8\u5206\u6821<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f14\u8bb2\u4e3b\u9898\uff1a\u5e7f\u544a\u62e6\u622a\uff08adblocking\uff09\uff1a\u4e00\u573a\u6ca1\u6709\u785d\u70df\u7684\u7f51\u7edc\u519b\u5907\u7ade\u8d5b<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5185\u5bb9\u6458\u8981\uff1a<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fd1\u5e74\u6765\uff0c\u4f34\u968f\u7740\u7f51\u7edc\u5e7f\u544a\u4ea7\u4e1a\u7684\u5d1b\u8d77\u548c\u6269\u5f20\uff0c\u8d8a\u6765\u8d8a\u591a\u4fb5\u5165\u5f0f\u3001\u607c\u4eba\u7684\u5728\u7ebf\u5e7f\u544a\u548c\u4e0e\u4e4b\u76f8\u4f34\u7684\u5728\u7ebf\u7528\u6237\u8ffd\u8e2a\u5df2\u7ecf\u4e25\u91cd\u5f71\u54cd\u548c\u4fb5\u72af\u4e86\u7528\u6237\u7684\u51b2\u6d6a\u4f53\u9a8c\u548c\u9690\u79c1\u3002\u5728\u8fd9\u79cd\u60c5\u51b5\u4e0b\uff0c\u8d8a\u6765\u8d8a\u591a\u7684\u7528\u6237\u9009\u62e9\u4f7f\u7528\u5e7f\u544a\u62e6\u622a\u8f6f\u4ef6\uff08adblocker\uff09\u6765\u6539\u5584\u4e0a\u7f51\u4f53\u9a8c\u3002\u622a\u81f32016\u5e749\u6708\uff0c\u636e\u7b2c\u4e09\u65b9\u516c\u53f8\u7edf\u8ba1\uff0c\u5168\u7403\u5df2\u6709\u8d85\u8fc76\u4ebf\u7684\u8bbe\u5907\u5728\u62e6\u622a\u5e7f\u544a\u3002\u4f5c\u4e3a\u56de\u51fb\uff0c\u8d8a\u6765\u8d8a\u591a\u7684\u5e7f\u544a\u670d\u52a1\u63d0\u4f9b\u5546\uff0c\u751a\u81f3\u7b2c\u4e09\u65b9\u516c\u53f8\uff0c\u5f00\u59cb\u90e8\u7f72\u548c\u63d0\u4f9b\u5e7f\u544a\u62e6\u622a\u53cd\u5236\u5668\uff08anti-adblocker\uff09\u3002\u5728\u8fd9\u6b21\u7684\u62a5\u544a\u4e2d\uff0c\u6211\u5c06\u4f1a\u4ecb\u7ecd\u5728\u8fc7\u53bb\u51e0\u5e74\u91cc\u6211\u4eec\u548c\u6211\u4eec\u7684\u5408\u4f5c\u7814\u7a76\u56e2\u961f\u5bf9\u4e8e\u81ea\u52a8\u5316\u68c0\u6d4b\u3001\u62e6\u622a\u548c\u7ed5\u5f00\u5728\u7ebf\u5e7f\u544a\u548c\u8ffd\u8e2a\u5668\u8d44\u6e90\uff0c\u4ee5\u53ca\u5e7f\u544a\u62e6\u622a\u53cd\u5236\u5668\u4ee3\u7801\u7684\u76f8\u5173\u5de5\u4f5c\u3002\u6211\u4eec\u91c7\u7528\u4e86\u52a8\u6001\u7a0b\u5e8f\u5206\u6790\u3001\u673a\u5668\u5b66\u4e60\u548c\u6d4f\u89c8\u5668\u63d2\u6869\u7b49\u6280\u672f\u65b9\u6cd5\u6765\u5206\u6790\u548c\u63a8\u8fdb\u8fd9\u573a\u4e0d\u65ad\u5347\u7ea7\u7684\u7f51\u7edc\u519b\u5907\u7ade\u8d5b\u3002\u76f8\u5173\u5de5\u4f5c\u7684\u6210\u679c\u5df2\u7ecf\u53d1\u8868\u5728\u5305\u62ecNDSS\u3001WWW\u3001Oakland\u7b49\u4e1a\u5185\u9876\u7ea7\u4f1a\u8bae\u4e0a\u3002\u6211\u4eec\u4e5f\u5f00\u6e90\u4e86\u76f8\u5173\u4ee3\u7801\uff0c\u5e76\u4e14\u88abBrave &#8212; \u4e00\u5bb6\u9690\u79c1\u5bfc\u5411\u7684\u6d4f\u89c8\u5668\u521b\u4e1a\u516c\u53f8\u6240\u4f7f\u7528\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f14\u8bb2\u5609\u5bbe\u7b80\u4ecb<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Shitong Zhu is currently a 4th-year CS Ph.D. candidate at UC Riverside, advised by Professor Zhiyun Qian. He has a broad interest in computer security and web privacy, with the general theme of analyzing and improving privacy and security on the web. Specifically, his past research projects have focused on adblocking. The techniques he applies include program analysis, browser modification\/instrumentation and machine learning. His work has appeared at top-tier venues in the field (NDSS\/WWW\/Oakland), and received a wide range of media coverage (e.g. TechCrunch).<\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72475-2.png\" alt=\"\" class=\"wp-image-3747\" width=\"95\" height=\"138\" srcset=\"http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72475-2.png 380w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72475-2-207x300.png 207w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2019\/12\/\u56fe\u72475-2-103x150.png 103w\" sizes=\"auto, (max-width: 95px) 100vw, 95px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">6\u3001\u6f14\u8bb2\u5609\u5bbe\uff1a\u674e\u5f3a \u534e\u4e3a\u6570\u5b57\u6280\u672f\u6709\u9650\u516c\u53f8<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f14\u8bb2\u4e3b\u9898\uff1a<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4ece\u4ea7\u4e1a\u5230\u5b66\u672f\u518d\u5230\u4ea7\u4e1a\uff0c\u91cd\u65b0\u8ba4\u8bc6\u5a01\u80c1\u60c5\u62a5<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5185\u5bb9<\/strong><strong>\u6458\u8981\uff1a<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u548c\u4e91\u8ba1\u7b97\u4e00\u6837\uff0c\u5a01\u80c1\u60c5\u62a5\u7684\u6982\u5ff5\u6700\u65e9\u4e5f\u662f\u7531\u4ea7\u4e1a\u754c\u63d0\u51fa\uff0c\u5b66\u672f\u754c\u8ddf\u8fdb\u7814\u7a76\uff0c\u5e76\u968f\u7740\u5a01\u80c1\u60c5\u62a5\u9010\u6b65\u6f14\u53d8\u6210\u4e3a\u4e00\u4e2a\u72ec\u7acb\u9886\u57df\uff0c\u4ea7\u4e1a\u754c\u548c\u5b66\u672f\u754c\u76f8\u4e92\u4fc3\u8fdb\uff0c\u5171\u540c\u63a8\u52a8\u5a01\u80c1\u60c5\u62a5\u7684\u53d1\u5c55\u548c\u843d\u5730\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u672c\u8bae\u9898\u9996\u5148\u4ece\u4ea7\u4e1a\u7684\u89d2\u5ea6\u5206\u6790\u5a01\u80c1\u60c5\u62a5\u63d0\u51fa\u7684\u80cc\u666f\u548c\u89e3\u51b3\u95ee\u9898\u7684\u601d\u8def\uff1b\u518d\u4ece\u5b66\u672f\u7684\u89d2\u5ea6\u5206\u6790\u5f53\u524d\u7684\u5a01\u80c1\u60c5\u62a5\u7814\u7a76\u65b9\u5411\u548c\u5185\u5bb9\uff1b\u7136\u540e\u4ece\u5a01\u80c1\u60c5\u62a5\u9886\u57df\u5168\u666f\u548c\u89e3\u51b3\u5b89\u5168\u4e1a\u52a1\u4e2d\u5b9e\u9645\u95ee\u9898\u7684\u89d2\u5ea6\uff0c\u4ecb\u7ecd\u5f53\u524d\u534e\u4e3a\u5b89\u5168\u5f00\u53d1\u90e8\u5728\u5a01\u80c1\u60c5\u62a5\u9886\u57df\u7684\u7814\u7a76\u5185\u5bb9\uff0c\u4ee5\u53ca\u672a\u6765\u7684\u7814\u7a76\u65b9\u5411\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f14\u8bb2\u5609\u5bbe\u7b80\u4ecb<\/strong><strong><\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u674e\u5f3a\uff0c2018\u5e74\u535a\u58eb\u6bd5\u4e1a\u4e8e\u4e2d\u56fd\u79d1\u5b66\u9662\u4fe1\u606f\u5de5\u7a0b\u7814\u7a76\u6240\uff0c\u73b0\u5c31\u804c\u4e8e\u534e\u4e3a\u6570\u5b57\u6280\u672f\u6709\u9650\u516c\u53f8\uff0c\u4e3b\u8981\u4ece\u4e8b\u5a01\u80c1\u60c5\u62a5\u4e1a\u52a1\u7684\u89c4\u5212\u548c\u9884\u7814\u5de5\u4f5c\uff0c\u4e3b\u8981\u5174\u8da3\u70b9\uff1a\u5a01\u80c1\u60c5\u62a5\u3001ATT&amp;CK\u3001SOAR\u7b49\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>2019\u5e7412\u670814\u65e5\uff08\u5468\u516d\uff09\u4e0b\u534813:30\uff0c\u897f\u5b89\u4ea4\u901a\u5927\u5b66\u7f51\u7edc\u5b89\u5168\u7814\u7a76\u56fd\u9645\u5b66\u672f\u8bba\u575b\u5c06\u5728\u897f\u4ea4\u5927\u5174\u5e86\u6821\u533a\u79d1\u5b66\u9986101\u4f1a\u8bae\u5ba4\u4e3e\u529e\u3002\u5185\u5bb9\u5305\u542b\u667a\u80fd\u5b89\u9632\u3001\u6df1\u5ea6\u5b66\u4e60\u3001\u57df\u540d\u534f\u8bae\u5b89\u5168\u3001\u5e7f\u544a\u62e6\u622a\u7b49\u3002 <a class=\"continue-reading-link\" href=\"http:\/\/202.112.238.40\/wp\/?p=3740\"> Continue reading <span class=\"meta-nav\">&rarr; <\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":3760,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-3740","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-events"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/3740","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3740"}],"version-history":[{"count":5,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/3740\/revisions"}],"predecessor-version":[{"id":3795,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/3740\/revisions\/3795"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/media\/3760"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3740"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3740"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3740"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}