CISPA
Browse
cispa_all_3596.pdf (761.18 kB)

Input Invariants

Download (761.18 kB)
conference contribution
posted on 2023-11-29, 18:19 authored by Dominic SteinhöfelDominic Steinhöfel, Andreas ZellerAndreas Zeller
How can we generate valid system inputs? Grammar-based fuzzers are highly efficient in producing syntactically valid system inputs. However, programs will often reject inputs that are semantically invalid. We introduce ISLa, a declarative specification language for context-sensitive properties of structured system inputs based on context-free grammars. With ISLa, it is possible to specify input constraints like “a variable has to be defined before it is used,” “the ‘file name’ block must be 100 bytes long,” or “the number of columns in all CSV rows must be identical.” Such constraints go into the ISLa fuzzer, which leverages the power of solvers like Z3 to solve semantic constraints and, on top, handles quantifiers and predicates over grammar structure. We show that a few ISLa constraints suffice to produce 100% semantically valid inputs while still maintaining input diversity. ISLa can also parse and precisely validate inputs against semantic constraints. ISLa constraints can be mined from existing input samples. For this, our ISLearn prototype uses a catalog of common patterns, instantiates these over input elements, and retains those candidates that hold for the inputs observed and whose instantiations are fully accepted by input-processing programs. The resulting constraints can then again be used for fuzzing and parsing.

History

Preferred Citation

Dominic Steinhöfel and Andreas Zeller. Input Invariants. In: European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE). 2022.

Primary Research Area

  • Threat Detection and Defenses

Name of Conference

European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE)

Legacy Posted Date

2022-03-28

Open Access Type

  • Green

BibTeX

@inproceedings{cispa_all_3596, title = "Input Invariants", author = "Steinhöfel, Dominic and Zeller, Andreas", booktitle="{European Software Engineering Conference and Symposium on the Foundations of Software Engineering (ESEC/FSE)}", year="2022", }

Usage metrics

    Categories

    No categories selected

    Exports

    RefWorks
    BibTeX
    Ref. manager
    Endnote
    DataCite
    NLM
    DC